User's Guide

ManualsBrandsMojo Networks ManualsElectronicsAccess Point / Sensor

AirTight Management Console Configuration

Prevention Level enables you to specify a trade-off between the desired level of prevention and the

desired number of multiple simultaneous preventions across radio channels.

The greater the number of channels across which simultaneous prevention is desired, the lesser is the

effectiveness of prevention in inhibiting unwanted communication. Scanning for new devices continues

regardless of the chosen prevention level.

You can select from the following intrusion prevention levels:



Block: A single sensor can block unwanted communication on any one channel in the 802.11b/g band

and any one channel in the 802.11a band.



Disrupt: A single sensor can disrupt unwanted communication on any two channels in the 802.11b/g

band and any two channels in the 802.11a band.



Interrupt: A single sensor can interrupt unwanted communication on any three channels in the

802.11b/g band and any three channels in the 802.11a band.



Degrade: A single sensor can degrade the performance of unwanted communication on any four

channels in 802.11b/g band and any four channels in the 802.11a band.

Block is the most powerful prevention level, that is, it can severely block almost all popular Internet

applications including ping, SSH, Telnet, FTP, HTTP, and the like. However, at this level, a single sensor

can simultaneously prevent unwanted communication on only one channel in the 802.11b/g band and

one channel in the 802.11a band. If you want the sensor to prevent unwanted communication on multiple

channels simultaneously in the 802.11 b/g and/or the 802.11a band, you must select other prevention

levels.

Note: Prevention Type determines the blocking strength to prevent communication from unwanted APs

and Clients. The system can prevent multiple APs and Clients on each channel. Prevention Type is not

applicable for Denial of Service (DoS) attacks or ad hoc networks. You must select a lower blocking level

to prevent devices on more channels. Choosing a lower blocking level means that some packets from the

blocked device may go through.

You can enable intrusion prevention against the following threats

Rogue APs: APs connected to your network but not authorized by the administrator; an attacker can

gain access to your network through the Rogue APs. You can also automatically quarantine

uncategorized, indeterminate and banned APs connected to the network.

Misconfigured APs: APs authorized by the administrator but do not conform to the security policy; an

attacker can gain access to your network through misconfigured APs. This could happen if the APs

are reset, tampered with, or if there is a change in the security policy.

Client Misassociations: Authorized Clients that connect to rogue or external (neighboring) APs;

corporate data on the authorized client is under threat due to such connections. AirTight recommends

that you provide automatic intrusion prevention against authorized clients that connect to rogue or

external APs.

There is a special intrusion prevention policy for the smart devices that are not approved. Even if a

current client policy restricts authorized clients from connecting to a guest AP, an unapproved smart

device can still be allowed to do so. One needs to explicitly allow or restrict unapproved smart devices

from connecting to a guest AP.

Click Special Handling for Smart Devices to enable special handling for unapproved smart devices.

You can allow the unapproved smart device to connect to a guest AP only. To do this,

Select Enable Special Handling for Unapproved Smart Devices.

2. Select Allow connection to Guest AP, but not Authorized AP.

To disallow the unapproved smart device from connecting to both a guest AP as well as an authorized

AP, select Do not allow connection to Guest AP and Authorized AP.