Users Guide

1. Navigate to the Monitoring > Controller > Clients page.
2. Select the client to be blacklisted, then click the Blacklist button.
To clear the entire client blacklist using the WebUI:
1. Navigate to the Monitoring > Controller > Clients page.
2. Click Remove All from Blacklist.
To manually blacklist a client via the command-line interface, access the CLI in config mode and issue the
following command:
stm add-blacklist-client <macaddr>
To clear the entire client blacklist using the command-line interface, access the CLI in config mode and issue the
following command:
stm purge-blacklist-client
Blacklisting by Authentication Failure
You can configure a maximum authentication failure threshold for each of the following authentication
methods:
l 802.1X
l MAC
l Captive portal
l VPN
When a client exceeds the configured threshold for one of the above methods, the client is automatically
blacklisted by the controller, an event is logged, and an SNMP trap is sent. By default, the maximum
authentication failure threshold is set to 0 for the above authentication methods, which means that there is no
limit to the number of times a client can attempt to authenticate.
With 802.1X authentication, you can also configure blacklisting of clients who fail machine authentication.
When clients are blacklisted because they exceed the authentication failure threshold, they are blacklisted
indefinitely by default. You can configure the duration of the blacklisting; see Setting Blacklist Duration on page
502.
To set the authentication failure threshold via the WebUI:
1. Navigate to the Configuration > Security > Authentication > Profiles page.
2. In the Profiles list, select the appropriate authentication profile, then select the profile instance.
3. Enter a value in the Max Authentication failures field.
4. Click Apply.
To set the authentication failure threshold via the command-line interface, access the CLI in config mode and
issue the following commands:
aaa authentication {captive-portal|dot1x|mac|vpn} <profile>
max-authentication-failures <number>
Enabling Attack Blacklisting
There are two types of automatic client blacklisting that can be enabled: blacklisting due to spoofed
deauthentication, or blacklisting due to other types of DoS attacks.
Automatic blacklisting for DoS attacks other than spoofed deauthentication is enabled by default. You can
disable this blacklisting on a per-SSID basis in the virtual AP profile.
Dell Networking W-Series ArubaOS 6.5.x | User Guide Wireless Intrusion Prevention |
501