Users Guide

500| Wireless Intrusion Prevention Dell Networking W-Series ArubaOS 6.5.x| User Guide
In the CLI
Use the following commands to add or remove MAC addresses from the valid-exempt list:
wms client <macaddr> valid-exempt insert
wms client <macaddr> valid-exempt remove
Use the following command to display a list of configured valid-exempt clients:
show wms client valid-exempt
Use the following command to display a list of clients that are viewed by the AP and marked as valid-exempt:
show ap monitor client-list ap-name <> valid-exempt
Use the following command to view the number of MAC addresses added to the valid-exempt client list:
show wms counters
Valid Exempt Station Macs
Understanding Client Blacklisting
When a client is blacklisted in the Dell system, the client is not allowed to associate with any AP in the network
for a specified amount of time. If a client is connected to the network when it is blacklisted, a deauthentication
message is sent to force the client to disconnect. While blacklisted, the client cannot associate with another
SSID in the network.
The controller retains the client blacklist in the user database, so the information is not lost if the controller
reboots. When you import or export the controller’s user database, the client blacklist will be exported or
imported as well.
Methods of Blacklisting
There are several ways in which a client can be blacklisted in the Dell system:
l You can manually blacklist a specific client. See Blacklisting Manually on page 500 for more information.
l A client fails to successfully authenticate for a configured number of times for a specified authentication
method. The client is automatically blacklisted. See Blacklisting by Authentication Failure on page 501 for
more information.
l A DoS or man in the middle (MITM) attack has been launched in the network. Detection of these attacks can
cause the immediate blacklisting of a client. See Enabling Attack Blacklisting on page 501 for more
information.
l An external application or appliance that provides network services, such as virus protection or intrusion
detection, can blacklist a client and send the blacklisting information to the controller via an XML API server.
When the controller receives the client blacklist request from the server, it blacklists the client, logs an event,
and sends an SNMP trap.
See External Services Interface on page 1040 for more information.
The External Services Interface feature require the Policy Enforcement Firewall Next Generation (PEFNG) license
installed in the controller.
Blacklisting Manually
There are several reasons why you may choose to blacklist a client. For example, you can enable different Dell
intrusion detection system (IDS) features that detect suspicious activities, such as MAC address spoofing or
DoS attacks. When these activities are detected, an event is logged and an SNMP trap is sent with the client
information. To blacklist a client, you need to know its MAC address.
To manually blacklist a client via the WebUI: