Catalyst 9800 Series Wireless Controller Software
Bukana ea Mosebelisi
Ho laola lisebelisoa tsa Rogue
Ho fumanoa ha Rogue
Lisebelisoa tsa Rogue
Libaka tsa phihlello tse fosahetseng li ka sitisa ts'ebetso ea LAN e se nang mohala ka ho koetela bareki ba molaong le ho sebelisa mongolo o hlakileng kapa litlhaselo tse ling tsa ho hana litšebeletso kapa litlhaselo tsa batho ba bohareng. Ka mantsoe a mang, senokoane se ka sebelisa sebaka sa phihlello se bohlasoa ho hapa tlhahisoleseling, joalo ka mabitso a basebelisi le li-password. Joale senokoane se ka fetisa letoto la liforeimi tsa Clear to Send (CTS). Ketso ena e etsisa sebaka sa ho fihlella, ho tsebisa mofani ea itseng hore a fetise, le ho laela bareki ba bang kaofela hore ba eme, e leng se etsang hore bareki ba amohelehang ba se ke ba khona ho fumana mehloli ea marang-rang. Bafani ba litšebeletso tsa LAN tse se nang mohala ba na le thahasello e matla ea ho thibela libaka tsa phihlello tse bohlasoa sebakeng sa moea.
Hobane libaka tsa phihlello tse bohlasoa li theko e tlase ebile li fumaneha habonolo, ka linako tse ling basebetsi ba hokela libaka tse sa lumelloeng tsa phihlello ho li-LAN tse seng li ntse li le teng ebe ba haha marang-rang a ad hoc ntle le tsebo kapa tumello ea lefapha la bona la IT. Lintlha tsena tse matla tsa ho fihlella li ka ba tlōlo e tebileng ea ts'ireletso ea marang-rang hobane li ka kenngoa ka har'a koung ea marang-rang ka morao ho firewall ea khoebo. Hobane basebetsi ka kakaretso ha ba lumelle litlhophiso life kapa life tsa ts'ireletso sebakeng sa ho kena ka bokhukhuni, ho bonolo hore basebelisi ba sa lumelloeng ba sebelise sebaka sa ho kena ho thibela sephethephethe sa marang-rang le ho koetela linako tsa bareki. Ho na le menyetla e mengata ea ho tlola ts'ireletso ea khoebo ha basebelisi ba se nang mohala ba hokela libakeng tsa phihlello ho netweke ea khoebo.
Tse latelang ke tse ling tsa litataiso tsa ho laola lisebelisoa tse kotsi:
- Libaka tsa phihlello li etselitsoe ho sebeletsa bareki ba amanang. Libaka tsena tsa phihlello li qeta nako e nyane li etsa scanning ntle le kanale: li-milliseconds tse ka bang 50 mocha ka mong. Haeba u batla ho bona palo e kholo ea li-AP le bareki ba nang le kutlo e phahameng, ho tlameha ho sebelisoe sebaka sa phihlello sa mokhoa oa ho shebella. Ntle le moo, o ka fokotsa linako tsa ho skena ho tloha ho metsotsoana e 180 ho ea ho boleng bo tlase, joalo ka mohlala.ample, metsotsoana e 120 kapa 60, ho etsa bonnete ba hore seea-le-moea se tima mocha khafetsa, e leng ho ntlafatsang menyetla ea ho fumanoa ka bolotsana. Leha ho le joalo, sebaka sa phihlello se ntse se tsoela pele ho sebelisa li-milliseconds tse ka bang 50 mocha ka mong.
- Ho sibolloa ha Rogue ho emisitsoe ka ho sa feleng bakeng sa Office Eketsa libaka tsa phihlello hobane libaka tsena tsa phihlello, tse fetiselitsoeng tikolohong ea lapeng, ho ka etsahala hore li bone lisebelisoa tse ngata tse senyehileng.
- Ts'ebetso ea karete ea bareki e ka fokotsa ts'ebetso ea thibelo. Hangata sena se etsahala ha moreki a ka hokela marang-rang kapele ka mor'a hore a fumane "de-association/de-authentication" foreimi, kahoo e ntse e ka khona ho fetisa sephethephethe. Leha ho le joalo, boiphihlelo ba ho bala ba moreki ea khopo bo tla ameha hampe ha bo le teng.
- Hoa khonahala ho arola le ho tlaleha lintlha tse mpe tsa phihlello ka ho sebelisa linaha tse sehloho le melaoana e hlalosoang ke basebelisi e lumellang linokoane hore li tsamaee lipakeng tsa linaha.
- Molaoli e mong le e mong o lekanyetsa palo ea li-container tse rogue ho tse tharo le tse tšeletseng seea-le-moea se seng le se seng bakeng sa libaka tsa ho fihlella ka mokhoa oa ho beha leihlo.
- Ha ts'ebetso ea matsoho e etsoa ho sebelisoa tlhophiso, ho kena ka bokhukhuni ho bolokoa le ka mor'a hore ho kenoa ka boqhetseke ho felile.
- Ha keno e mpe e felile, libaka tsa phihlello tse laoloang li laeloa ho emisa sets'oants'o sefe kapa sefe se sebetsang ho eona.
- Ha Validate Rogue AP Khahlanong le AAA e lumelletsoe, molaoli o kopa seva sa AAA bakeng sa likarolo tse mpe tsa AP ka nako e hlophisitsoeng.
- Ho netefatsa Rogue AP khahlano le AAA, eketsa AP MAC e sa sebetseng ho database ea AAA e nang le delimiter e nepahetseng, lebitso la mosebelisi le password e le aterese ea MAC e nang le delimiter e loketseng. The Access-Accept e na le Cisco-AV-pair e nang le le leng la mantsoe a bohlokoa a latelang:
- rogue-ap-state=boemo
Hlokomela
Mona, seemo e ka ba e 'ngoe ea mefuta, e leng: tlhokomeliso, se na, kahare, kantle, kapa tšoso.
- rogue-ap-class=sehlopha
Hlokomela
Mona, sehlopha e ka ba e 'ngoe ea mefuta, e leng: e sa hlophisoang, e khopo, kapa e mosa.
Tse latelang ke metsoako e lumelletsoeng ea sehlopha kapa naha:
- unclassified/ Ketso ya ho hlokomedisa: ho hlokomedisa, ho tshosa, kapa tshoso.
- malicious/ Ketso ya ho falimeha: e hlokolosi, e tshosa, kapa tshoso.
- botsoalle: ho falimeha, ka hare, kapa kantle.
Radius Access-Reject bakeng sa netefatso e mpe ea AP AAA e hlokomolohuoa.
- Ha Validate Rogue Clients Khahlanong le AAA e nolofalitsoe, molaoli o kopa seva sa AAA bakeng sa netefatso ea moreki ea rogue hang feela. Ka lebaka leo, haeba netefatso ea bareki e sa atlehe tekong ea pele, moreki ea khopo ha a sa tla hlola a bonoa e le tšokelo. Ho qoba sena, kenya dikenyo tse nepahetseng tsa moreki ho sebara ya netefatso pele o bulela Netefatsa Bareki ba Rogue Kgahlanong le AAA.
Lithibelo ho Khethollo ea Rogue
- Tšebeliso e mpe ha e tšehetsoe likanaleng tsa DFS.
Sebaka sa phihlello se bohlasoa se isoa boemong bo sa tsitsang, ka bohona kapa ka letsoho. Mookameli o khetha sebaka se setle ka ho fetisisa se fumanehang bakeng sa ho boloka ebe o sutumelletsa tlhahisoleseding sebakeng sa ho fihlella. Sebaka sa phihlello se boloka lethathamo la lisebelisoa ka radio. Bakeng sa polokelo ea likoloi, o ka etsa hore molaoli a sebelise sebaka sa phihlello sa "monitor mode". Ts'ebetso ea ho koala e etsoa ka litsela tse peli:
- Sebaka sa ho fihlella setshelo se feta lethathamong la lisebelisoa nako le nako 'me se romela liforeimi tsa sephutheloana sa unicast. Bakeng sa thibelo ea sebaka sa phihlello, liforeimi li romelloa feela haeba moreki ea khopo a amahanngoa.
- Nako le nako ha ts'ebetso e mpe e bonoang, liforeimi tsa polokelo lia fetisoa.
Tšireletso ea motho ka mong e kenyelletsa ho romella letoto la ho ikarola ha unicast le liforeimi tsa netefatso.
Ho tloha 17.7.1 ho lokolloa ho ea pele, Beacon DS Attack le Beacon Wrong Channel signatures li ile tsa hlahisoa.
Beacon DS Attack-Ha li-AP tse laoloang le tse mabifi li sebelisa BSSID e tšoanang, li-AP tse khopo li bitsoa baetsisi. Motho ea hlaselang a ka eketsa karolo ea Direct-Sequence sete ea tlhaiso-leseling ka nomoro efe kapa efe ea mocha. Haeba nomoro ea mocha e ekelitsoeng e fapane le nomoro ea mocha e sebelisoang ke AP e laoloang, tlhaselo eo e bitsoa Beacon DS Attack.
Beacon Wrong Channel-Ha li-AP tse laoloang le tse mabifi li sebelisa BSSID e tšoanang, li-AP tse mabifi li bitsoa baetsi ba AP. Haeba moetsi oa AP a sebelisa nomoro ea mocha e fapaneng le e sebelisoang ke AP e laoloang ka BSSID e tšoanang, tlhaselo e bitsoa Beacon Wrong Channel. Boemong bo joalo, Karolo ea Boitsebiso ba Tatelano ea Direct-Sequence e kanna ea se be teng le foreiming ea Beacon.
Cisco Prime Infrastructure Interaction le Rogue Detection
Cisco Prime Infrastructure e tšehetsa lihlopha tse thehiloeng ho melao le ho sebelisa melao ea lihlopha e hlophisitsoeng ho molaoli. Mookameli o romela maraba ho Cisco Prime Infrastructure ka mor'a liketsahalo tse latelang:
- Haeba sebaka se sa tsejoeng sa ho fihlella se fallela sebakeng sa Motsoalle ka lekhetlo la pele, molaoli o romela leraba ho Cisco Prime Infrastructure hafeela boemo bo bobe bo le Tlhokomeliso. Ha e romele leraba haeba boemo bo bobe bo le ka hare kapa ka ntle.
- Haeba ho kenoa ka bokhukhuni ho tlosoa ka mor'a hore nako ea nako e felile, molaoli o romela leraba ho Cisco Prime Infrastructure bakeng sa libaka tsa ho fihlella tse sehlōhō tse arotsoeng e le Malicious (Alert, Threat) kapa Unclassified (Alert). Mookameli ha a tlose lipeeletso tse fosahetseng tse nang le lipolelo tse latelang tse sa tsitsang: E na le, e na le Teng, e ka hare le e ka ntle.
Tlhahisoleseding mabapi le Rogue Containment (Protected Management Frames (PMF) E lumelitsoe)
Ho tloha ho Cisco IOS XE Amsterdam, 17.3.1 ho ea pele, lisebelisoa tse rogue tse nolofalitsoeng ka 802.11w Protected Management Frames (PMF) ha li fumanehe. Ho e-na le hoo, sesebelisoa se bohlasoa se tšoailoe e le Contained Pending, 'me ho phahamisoa alamo ea WSA ho tsebisa ka ketsahalo e Emetseng e Tlamehile. Hobane sesebelisoa sa sesebelisoa ha se etsoe, lisebelisoa tsa phihlello (AP) ha li sebelisoe ho sa hlokahale.
Hlokomela
Karolo ena e tšehetsoa feela ho Wave 2 APs.
Matha pontšo e se nang mohala wps rogue ap taelo e qaqileng ea ho netefatsa sephutheloana sa sesebelisoa, ha PMF e nolofalitsoe ka sesebelisoa se thata.
AP Ho lemoha ho Ikentse
Mekhoa e fapaneng ea ho lemoha boikaketsi ba AP ke:
- Boiketsiso ba AP bo ka bonoa haeba AP e laoloang e tlalehile e le Rogue. Mokhoa ona o lula o sebetsa 'me ha ho tlhophiso e hlokahalang.
- Ho lemoha boikaketsi ba AP ho ipapisitse le MFP.
- AP ea ho lemoha ha motho e mong e ipapisitse le netefatso ea AP.
Infrastructure MFP e sireletsa mesebetsi ea tsamaiso ea 802.11 ka ho eketsa lintlha tsa tlhahisoleseding ea molaetsa oa botšepehi (MIC), ho liforeimi tsa tsamaiso tse rometsoeng ke APs (eseng tse rometsoeng ke bareki), tseo ka nako eo li netefalitsoeng ke li-AP tse ling marang-rang. Haeba MFP ea meralo ea motheo e lumelletsoe, li-AP tse laoloang li hlahloba hore na likarolo tsa tlhahisoleseling tsa MIC li teng le hore na lintlha tsa tlhahisoleseling tsa MIC li lebeletsoe. Haeba e 'ngoe ea maemo ana e sa phethahale, AP e laoloang e romella litlaleho tsa AP tse nang le k'hamera e ntlafalitsoeng ea AP ea ho hloleha ho netefatsa.
Ts'ebetso ea AP Authentication e u lumella ho bona boikaketsi ba AP. Ha o nolofalletsa ts'ebetso ena, molaoli o etsa lekunutu la AP mme o le arolelana le li-AP tse ling marang-rang a tšoanang. Sena se lumella APs ho netefatsana.
Karolo ea tlhaiso-leseling ea AP e khomaretsoe ho liforeimi tsa karabo ea beacon le probe. Haeba karolo ea tlhaiso-leseling ea AP e na le sebaka se fosahetseng sa Signature, kapa linakoamp e timme, kapa haeba karolo ea tlhaiso-leseling ea AP e le sieo, AP e lemohileng boemo bo joalo e eketsa lebala la ho hloleha ha netefatso ea AP. Alamo ea boikaketsi e hlahisoa ka mor'a hore karolo ea AP e hlōlehe ho netefatsa hore e tlōla moeli oa eona. The rogue AP e khetholloa e le Malicious with state Threat.
Sebelisa taelo ea "wireless wps rogue ap" ho bona hore na boikaketsi bo fumanoa neng ka lebaka la liphoso tsa netefatso.
Ho Lokisa Tšebeliso ea Rogue (GUI)
Tsamaiso
| Mohato oa 1 | Khetha Configuration > Tags & Profiles > Kena AP. |
| Mohato oa 2 | Tobetsa AP Join Profile Lebitso la ho hlophisa setsebi sa APfile thepa. |
| Mohato oa 3 | Ho Edit AP Join Profile fensetereng, tobetsa konopo ea Rogue AP. |
| Mohato oa 4 | Sheba lebokose la ho hlahloba la Rogue Detection ho nolofalletsa ho lemoha ka mokhoa o mabifi. |
| Mohato oa 5 | Lefapheng la Rogue Detection Minimum RSSI, kenya boleng ba RSSI. |
| Mohato oa 6 | Lebaleng la Rogue Detection Transient Interval, kenya nako ka metsotsoana. |
| Mohato oa 7 | Karolong ea Nako ea Nako ea Tlaleho ea Rogue Detection, kenya boleng ba nako ea tlaleho ka metsotsoana. |
| Mohato oa 8 | Lepatlelong la Rogue Detection Client Number Threshold, kenya moeli oa ho fumana moreki o mobe. |
| Mohato oa 9 | Sheba lebokose la tlhahlobo la Auto Containment ho Flex Connect Standalone ho thusa ho boloka likoloi. |
| Mohato oa 10 | Tobetsa Update & Sebelisa ho Sesebediswa. |
Ho Hlophisa Rogue Detection (CLI)
Tsamaiso
| Taelo kapa Ketso | Morero | |
| Mohato oa 1 | lokisa terminal ExampLe: Sesebelisoa# lokisa terminal | E kenya mokhoa oa tlhophiso ea lefats'e. |
| Mohato oa 2 | app ea profile profile-lebitso rogue discovery min-rssi rssi ho dBm ExampLe: Sesebelisoa(config)# app ea profile profile1 Sesebelisoa(config)# rogue ho lemoha min-rssi -100 |
Hlalosa boleng bo tlase ba RSSI boo linokoane li lokelang ho ba le bona hore li-AP li lemohe le hore ho kenoe ka mokhoa o bohlasoa sesebelisoa. Sebaka se sebetsang bakeng sa parameter ea rssi ho dBm ke -128 dBm ho ea ho -70 dBm, 'me boleng ba kamehla ke -128 dBm. Hlokomela Karolo ena e sebetsa ho mefuta eohle ea AP. Ho ka ba le linokoane tse ngata tse nang le litekanyetso tse fokolang tsa RSSI tse sa faneng ka tlhahisoleseling efe kapa efe ea bohlokoa tlhahlobong e mpe. Ka hona, o ka sebelisa khetho ena ho sefa likhoka ka ho hlakisa boleng bo tlase ba RSSI boo li-AP li lokelang ho bona linokoane. |
| Mohato oa 3 | app ea profile profile-lebitso thibelo ea ho fumanoa ha moferefere {tekanyo e iketsang | flex-rate} ExampLe: Sesebelisoa(config)# app ea profile profile1 Sesebelisoa(config)# Rogue discoverment containment flex-rate |
E totobatsa likhetho tse tloaelehileng tsa ho kotula. The tekanyo e iketsang khetho e nolofalletsa sekhahla sa boits'oaro bakeng sa thibelo ea linokoane. The flex-rate khetho e etsa hore ho be le ts'ebetso e matla ea li-APs tsa standalone flexconnect. |
| Mohato oa 4 | ap profile profile-lebitso sekgoahlapi ho lemoha nolofalletsa ExampLe: Sesebelisoa(config)# app ea profile profile1 Sesebelisoa(config)# ho fumaneha ha likhoka ho thusa |
E thusa ho lemoha ka bokhukhuni ho li-AP tsohle. |
| Mohato oa 5 | app ea profile profile-lebitso nako ea tlaleho ea rogue discovery nako ka metsotswana ExampLe: Sesebelisoa(config)# app ea profile profile1 Sesebelisoa(config)# Nako ea tlaleho ea ho fumanoa ha rogue 120 |
E lokisa nako ea tlaleho ea rogue bakeng sa mokhoa oa ho beha leihlo Cisco APs. Nako e nepahetseng ea ho tlaleha nako ka metsotsoana ke metsotsoana e 10 ho isa ho metsotsoana e 300. |
E lokisa RSSI Deviation Notification Threshold for Rogue APs (CLI)
Tsamaiso
| Taelo kapa Ketso | Morero | |
| Mohato oa 1 | lokisa terminal ExampLe: Sesebelisoa# lokisa terminal |
E kenya mokhoa oa tlhophiso ea lefats'e. |
| Mohato oa 2 | wireless wps rogue ap notify-rssi-deviation ExampLe: Sesebelisoa(config)# wireless wps rogue ap notify-rssi-deviation |
E lokisa moeli oa tsebiso ea RSSI bakeng sa Rogue APs. |
| Mohato oa 3 | QETA ExampLe: Sesebelisoa(config)# QETA |
E khutlela ho mokhoa o khethehileng oa EXEC. Ntle le moo, o ka tobetsa hape Ctrl-Z ho tsoa mokhoeng oa tlhophiso ea lefatše. |
Ho hlophisa Tšireletso ea Frame ea Tsamaiso (GUI)
Tsamaiso
| Mohato oa 1 | Khetha Configuration> Tshireletso> Melao ea Tšireletso e se nang Wire. |
| Mohato oa 2 | Ka har'a Leano la Rogue tab, tlas'a karolo ea MFP Configuration, hlahloba lebokose la tlhahlobo la Global MFP State le lebokose la tlhahlobo la AP Impersonation Detection ho nolofalletsa boemo ba MFP lefatšeng ka bophara le ho lemoha boikaketsi ba AP, ka ho latellana. |
| Mohato oa 3 | Lebaleng la MFP Key Refresh Interval, bolela nako ea ho khatholla ka lihora tse ngata. |
| Mohato oa 4 | Tobetsa Etsa kopo. |
Ho hlophisa Tšireletso ea Frame ea Tsamaiso (CLI)
| Taelo kapa Ketso | Morero | |
| Mohato oa 1 | lokisa terminal ExampLe: Sesebelisoa # lokisa terminal |
E kenya mokhoa oa tlhophiso ea lefats'e. |
| Mohato oa 2 | Waelese wps mfp ExampLe: Sesebelisoa(config)# wireless wps mfp |
E lokisa tšireletso ea foreimi ea tsamaiso. |
| Mohato oa 3 | Waelese wps mfp {ap-ketsiso | senotlolo-refresh-nako} ExampLe: Sesebelisoa(config)# wireless wps mfp ap-impersonation Sesebelisoa(config)# wireless wps mfp key-refresh-interval |
E lokisa ho lemoha ha motho a ikeketsa (kapa) nako ea ho hlasimolla senotlolo sa MFP ka lihora tse ngata. key-refresh-interval-E bua ka nako ea ho tsosolosa senotlolo sa MFP ka lihora. Lethathamo le nepahetseng ke ho tloha ho 1 ho isa ho 24. Theko ea kamehla ke 24. |
| Mohato oa 4 | QETA ExampLe: Sesebelisoa(config)# pheletso |
E boloka tlhophiso le ho tsoa boemong ba tlhophiso ebe e khutlela ho tse khethehileng EXEC mokgoa. |
E nolofalletsa Netefatso ea Sebaka sa ho fihlella
Tsamaiso
| Taelo kapa Ketso | Morero | |
| Mohato oa 1 | lokisa terminal ExampLe: Sesebelisoa # lokisa terminal |
E kenya mokhoa oa tlhophiso ea lefats'e. |
| Mohato oa 2 | netefatso ea wps ap-wireless ExampLe: Sesebelisoa(config)# netefatso ea wps ap-wireless |
E lokisa netefatso ya waelese ya WPS AP. |
| Mohato oa 3 | Wiele wps ap-tiisetso threshold monyako ExampLe: Sesebelisoa(config)# wireless wps ap-authentication threshold 100 |
E lokisa netefatso ea moahelani oa AP 'me e beha moeli bakeng sa liphoso tsa netefatso ea AP. |
| Mohato oa 4 | wlan wlan-name wlan-id SSID-lebitso ExampLe: Sesebelisoa(config)# wlan wlan-demo 1 ssid-demo |
E lokisa WLAN. |
| Mohato oa 5 | ccx aironet-iesupport ExampLe: Sesebelisoa(config-wlan)# ccx aironet-iesupport |
E nolofalletsa tšehetso bakeng sa Lintlha tsa Boitsebiso ba Aironet ho WLAN ena. |
| Mohato oa 6 | QETA ExampLe: Sesebelisoa # pheletso | E khutlela ho mokhoa o khethehileng oa EXEC. |
Ho netefatsa Tšireletso ea Frame ea Tsamaiso
Ho netefatsa hore na karolo ea Management Frame Protection (MFP) e lumelletsoe kapa che, sebelisa taelo e latelang:
Ho view lintlha tsa MFP, sebelisa taelo e latelang:
Ho netefatsa Liketsahalo tse Rogue
Ho netefatsa nalane ea ketsahalo e mpe, tsamaisa lenaneo le qaqileng la wps rogue ap:
Ho netefatsa ho fumanoa ha Rogue
Karolo ena e hlalosa taelo e ncha ea ho sibolla bosholu.
Taelo e latelang e ka sebelisoa ho netefatsa ho fumanoa ha rogue sesebelisoa.
Lethathamo la 1: Ho netefatsa Boitsebiso ba Adhoc Rogues
| Taelo | Morero |
| bontsha waelese wps sekgoahlapi ea tlas'a maemo qaqisitsoe mac_aterese | E bonts'a lintlha tse qaqileng bakeng sa Adhoc rogue. |
| bonts'a kakaretso e akaretsang ea wps rogue adhoc | E bonts'a lethathamo la linokoane tsohle tsa Adhoc. |
Lethathamo la 2: Ho netefatsa Boitsebiso ba Rogue AP
| Taelo | Morero |
| bonts'a bareki ba wps rogue ap e se nang mohala mac_aterese | E bonts'a lenane la bareki bohle ba qhekellang ba amanang le rague. |
| bontša kakaretso wps rogue ap tloaelo e se nang mohala | E bonts'a tlhaiso-leseling ea tloaelo ea AP. |
| bonts'a li-wireless wps rogue ap e qaqileng mac_aterese | E bonts'a lintlha tse qaqileng bakeng sa AP e khopo. |
| bonts'a kakaretso e bonolo ea wps ea rogue ap | E bonts'a tlhaiso-leseling e bonolo ea AP. |
| bonts'a lethathamo la li-wireless wps rogue ap mac_aterese | E bonts'a lenane la li-AP tse qhekellang tse fumanoeng ke AP e fanoeng. |
| bonts'a kakaretso e kotsi ea wps e rogue ap | E bonts'a lintlha tse mpe tsa AP. |
| bonts'a kakaretso ea kakaretso ea wps e se nang mohala | E bonts'a lethathamo la li-AP tsohle tsa Rogue. |
| bontsha waelese wps sekgoahlapi ap unclassified kakaretso | E bonts'a tlhaiso-leseling e sa tsejoeng ea AP. |
Lethathamo la 3: Ho netefatsa Boitsebiso ba Rogue Auto-Containment
| Taelo | Morero |
| bontsha waelese wps sekgoahlapi e nang le boits'oaro | E bonts'a tlhahisoleseling e fosahetseng ea boits'oaro. |
Lethathamo la 4: Ho netefatsa Boitsebiso ba Molao oa Sehlopha
| Taelo | Morero |
| bontsha waelese wps sekgoahlapi busa qaqisitsoe molao_lebitso | E bonts'a lintlha tse qaqileng bakeng sa molao oa lihlopha. |
| bonts'a kakaretso ea melao e thata ea wps e se nang mohala | E bonts'a lethathamo la melao eohle e fosahetseng. |
Lethathamo la 5: Ho netefatsa Lipalopalo tsa Rogue
| Taelo | Morero |
| bontsha waelese wps sekgoahlapi lipalo-palo | E bonts'a lipalo-palo tse mpe. |
Lethathamo la 6: Ho netefatsa Litaba tsa bareki ba Rogue
| Taelo | Morero |
| bontsha waelese wps sekgoahlapi moreki qaqisitsoe mac_aterese | E hlahisa lintlha tse qaqileng bakeng sa moreki oa Rogue. |
| bonts'a kakaretso ea kakaretso ea moreki ea se nang mohala ea wps | E bonts'a lenane la bareki bohle ba Rogue. |
Lethathamo la 7: Netefatsa Lethathamo la Batho ba Rogue Ignore
| Taelo | Morero |
| bontsha waelese wps sekgoahlapi hlokomoloha-lethathamo | E bonts'a lenane la batho ba sa tsotelleng. |
ExampLes: Rogue Detection Configuration
Exampe bonts'a mokhoa oa ho lokisa bonyane ba RSSI eo AP e lemohileng e tlamehang ho ba ho eona, ho ba le keno e entsoeng sesebelisoa:
Ho Lokisa Maano a Rogue (GUI)
Tsamaiso
| Mohato oa 1 | Khetha Configuration> Tshireletso> Melao ea Tšireletso e se nang Wire. |
| Mohato oa 2 | Ka har'a "Rogue Policies" tab, sebelisa ho theoha ha Rogue Detection Security Level ho khetha boemo ba ts'ireletso. |
| Mohato oa 3 | Karolong ea Phello ea Nako bakeng sa Rogue APs (metsotsoana), kenya boleng ba nako ea ho tsoa. |
| Mohato oa 4 | Khetha Netefatsa Bareki ba Rogue khahlano le lebokose la tlhahlobo la AAA ho netefatsa bareki ba bolotsana khahlano le seva sa AAA. |
| Mohato oa 5 | Khetha li-APs tsa Validate Rogue khahlano le lebokose la tlhahlobo la AAA ho netefatsa libaka tsa phihlello tse fosahetseng khahlano le seva sa AAA. |
| Mohato oa 6 | Sebakeng sa Rogue Polling Interval (metsotsoana), kenya nako ea ho khetha seva sa AAA bakeng sa tlhaiso-leseling e fosahetseng. |
| Mohato oa 7 | Khetha lebokose la ho hlahloba le ho tlaleha Adhoc Networks ho thusa ho lemoha marang-rang a rogue adhoc. |
| Mohato oa 8 | Sebakeng sa Rogue Detection Client Number Threshold, kenya monyako ho hlahisa sefi sa SNMP. |
| Mohato oa 9 | Karolong ea Auto Contain, kenya lintlha tse latelang. |
| Mohato oa 10 | Sebelisa boemo ba Auto Containment Level ho khetha boemo. |
| Mohato oa 11 | Khetha "Auto Containment" feela bakeng sa Monitor Mode APs lebokose la ho hlahloba ho fokotsa ts'ebetso ea likoloi feela ho beha leihlo li-APs tsa mode. |
| Mohato oa 12 | Khetha lebokose la ho hlahloba la Rogue on Wire ho fokotsa boits'oaro bo ikemetseng feela ho li-AP tse mabifi ka terata. |
| Mohato oa 13 | Khetha Ho sebelisa lebokose la rona la ho hlahloba la SSID ho fokotsa li-auto-containment feela ho li-AP tse mabifi u sebelisa e 'ngoe ea SSID e hlophisitsoeng ho molaoli. |
| Mohato oa 14 | Khetha lebokose la ho hlahloba la Adhoc Rogue AP ho fokotsa li-auto-containment feela ho adhoc rogue APs. |
| Mohato oa 15 | Tobetsa Etsa kopo. |
Ho Lokisa Maano a Rogue (CLI)
Tsamaiso
| Taelo kapa Ketso | Morero | |
| Mohato oa 1 | lokisa terminal ExampLe: Sesebelisoa# lokisa terminal |
E kenya mokhoa oa tlhophiso ea lefats'e. |
| Mohato oa 2 | ExampLe: Sesebelisoa(config)# Wiele wps rogue security-level tloaelo |
E lokisa boemo ba ts'ireletso ea bosholu. U ka khetha nyatsa bakeng sa lisebelisoa tse matla haholo, tloaelo bakeng sa boemo ba ts'ireletso bo ikhethileng, hodimo bakeng sa thomello ea maemo a mahareng, le tlase bakeng sa thomelo e nyane. |
| Mohato oa 3 | wireless wps rogue ap timeout palo ea metsotsoana ExampLe: Sesebelisoa(config)# wireless wps rogue ap timeout 250 | E lokisa nako ea ho felloa ke nako ea likenyo tse fosahetseng, ka metsotsoana. Nako e nepahetseng bakeng sa nako ka metsotsoana e 240 ho isa ho metsotsoana e 3600. |
| Mohato oa 4 | ExampLe: Sesebelisoa(config)# wireless wps rogue moreki aaa |
E lokisa tšebeliso ea AAA kapa database ea lehae ho bona liaterese tse nepahetseng tsa MAC. |
| Mohato oa 5 | ExampLe: Sesebelisoa(config)# wireless wps rogue client mse |
E lokisa tšebeliso ea MSE ho fumana liaterese tse nepahetseng tsa MAC. |
| Mohato oa 6 | wireless wps rogue client notify-min-rssi Boemo ba RSSI ExampLe: Sesebelisoa(config)# wireless wps rogue client notify-min-rssi -128 |
E lokisa maemo a tlase a tsebiso ea RSSI bakeng sa bareki ba bolotsana. Sebaka se sebetsang bakeng sa moeli oa RSSI ho dB ke -128 – dB ho ea ho -70 dB. |
| Mohato oa 7 | waelese wps rogue moreki tsebisa-motsotso-ho kheloha Boemo ba RSSI ExampLe: Sesebelisoa(config)# wireless wps rogue client notify-min-deviation 4 |
E lokisa moeli oa tsebiso ea RSSI bakeng sa bareki ba bolotsana. Sebaka se sebetsang bakeng sa moeli oa RSSI ho dB ke 0 dB ho isa ho 10 dB. |
| Mohato oa 8 | wireless wps rogue ap aaa ExampLe: Sesebelisoa(config)# wireless wps rogue ap aaa |
E lokisa ts'ebeliso ea AAA kapa database ea lehae ho hlophisa AP ea botsotsi ho latela liaterese tse mpe tsa AP MAC. |
| Mohato oa 9 | wireless wps rogue ap aaa polling-interval AP AAA karohano ExampLe: Sesebelisoa(config)# wireless wps rogue ap aaa nako ea likhetho 120 |
E lokisa nako ea netefatso ea AP AAA. Nako e nepahetseng bakeng sa nako ea AP AAA ka metsotsoana ke metsotsoana e 60 ho isa ho metsotsoana e 86400. |
| Mohato oa 10 | wireless wps rogue adhoc ExampLe: Sesebelisoa(config)# waelese wps sekgoahlapi ea tlas'a maemo |
E nolofalletsa ho lemoha le ho tlaleha adhoc rogue (IBSS). |
| Mohato oa 11 | wireless wps rogue client client-threshold monyako ExampLe: Sesebelisoa(config)# wireless wps rogue client client-threshold 100 |
E lokisa moreki ea khopo ho ea ka moeli oa serai sa AP SNMP. Nako e nepahetseng bakeng sa litekanyo ke 0 ho isa ho 256. |
| Mohato oa 12 | wireless wps rogue ap ho eona-timer ExampLe: Sesebelisoa(config)# wireless wps rogue ap ho eona-timer 180 | E lokisa sebali sa nako se ho eona bakeng sa li-AP tse sa sebetseng. Boleng ba nako ea kamehla bo behiloe ho metsotsoana e 180. Hlokomela Ha AP e bohlasoa e fumanoa, ho qala nako ho eona 'me melao e sebelisoa ha nako ena e fela. Sena se lumella tlhahisoleseling ea AP hore e tsitse pele e sebelisa melao leha e le efe. Leha ho le joalo, o ka fetola boleng ba nako ena ka ho sebelisa taelo ena. Ka mohlala, nako ea ho eona e ka behoa ho 0, haeba melao e lokela ho sebelisoa hang ha AP e ncha e fumanoa. |
Boemo ba Tšireletso ea Rogue Detection
Tlhophiso ea boemo ba ts'ireletso ea ts'ireletso ea rogue e u lumella ho beha liparamente tse sibollang.
Maemo a teng a tšireletso ke:
- Bohlokoa: Ho fumanoa ha bosholu bakeng sa lisebelisoa tse hlokolosi haholo.
- Holimo: Pono ea mantlha ea bosholu bakeng sa thomello ea maemo a mahareng.
- Tlase: Ho fumanwa ha bosholu bakeng sa dithomelo tse nyane.
- Tloaelo: Boemo ba ts'ireletso ea kamehla, moo liparamente tsohle tsa ho lemoha li ka lokisoang.
Hlokomela
Ha e le Critical, High or Low, some rogue parameters are fixed 'me ha e khone ho hlophisoa.
Tafole e latelang e bonts'a lintlha tsa paramethara bakeng sa maemo a mararo a boletsoeng esale pele:
Lethathamo la 8: Boikutlo ba Rogue: Maemo a boletsoeng esale pele
| Paramethara | Bohlokoa | Phahameng | Tlase |
| Nako ea ho hloekisa | 3600 | 1200 | 240 |
| AAA Netefatsa Bareki | E holofetse | E holofetse | E holofetse |
| AAA netefatsa AP | E holofetse | E holofetse | E holofetse |
| Tlaleho ea Adhoc | E lumelletsoe | E lumelletsoe | E lumelletsoe |
| Nako ea Tlaleho ea Mokhoa oa ho Lekola | 10 metsotsoana | 30 metsotsoana | 60 metsotsoana |
| Bonyane RSSI | -128 dBm | -80 dBm | -80 dBm |
| Nako e Fetileng | 600 metsotsoana | 300 metsotsoana | 120 metsotsoana |
| Auto Contain E sebetsa feela ho Monitor Mode APs. | E holofetse | E holofetse | E holofetse |
| Auto E na le Boemo | 1 | 1 | 1 |
| Auto E na le Same-SSID | E holofetse | E holofetse | E holofetse |
| E na le Bareki ba Hantle ho Rogue AP | E holofetse | E holofetse | E holofetse |
| Auto E na le Adhoc | E holofetse | E holofetse | E holofetse |
| Containment Auto-Rate | E lumelletsoe | E lumelletsoe | E lumelletsoe |
| Netefatsa bareki ka CMX | E lumelletsoe | E lumelletsoe | E lumelletsoe |
| Containment Flex Connect | E lumelletsoe | E lumelletsoe | E lumelletsoe |
Ho beha boemo ba Tšireletso ea Rogue Detection
Latela mokhoa o fanoeng ka tlase ho beha boemo ba ts'ireletso ea bosholu:
Tsamaiso
| Taelo kapa Ketso | Morero | |
| Mohato oa 1 | lokisa terminal ExampLe: Sesebelisoa # lokisa terminal |
E kenya mokhoa oa tlhophiso ea lefats'e. |
| Mohato oa 2 | Wiele wps rogue security-level tloaelo ExampLe: Sesebelisoa(config)# wireless wps tloaelo ea boemo ba ts'ireletso e thata |
E lokisa boemo ba ts'ireletso ea ts'ireletso joalo ka tloaelo. |
| Mohato oa 3 | wireless wps rogue security-level e tlase ExampLe: Sesebelisoa(config)# wireless wps rogue security-level e tlase |
E lokisa boemo ba ts'ireletso ea bosholu bakeng sa litlhophiso tsa mantlha tsa tšibollo e mpe bakeng sa lisebelisoa tse nyane. |
| Mohato oa 4 | wireless wps rogue security-level e phahameng ExampLe: Sesebelisoa(config)# wireless wps rogue security-level e phahameng |
E lokisa boemo ba ts'ireletso ea bosholu bakeng sa litlhophiso tsa tšibollo e mpe bakeng sa lisebelisoa tsa maemo a mahareng. |
| Mohato oa 5 | wireless wps rogue tshireletso boemo ba bohlokoa ExampLe: Sesebelisoa(config)# wireless wps rogue security level ea bohlokoa |
E lokisa boemo ba ts'ireletso ea ts'ireletso bakeng sa litlhophiso tsa tšibollo e mpe bakeng sa lisebelisoa tse hlokolosi haholo. |
Wireless Service Assurance Rogue Events
Wireless Service Assurance (WSA) diketsahalo tse mpe, tse tshehetswang ho Tokollo 16.12.x le ho lokollwa ha morao, di na le ditsebiso tsa telemetry bakeng sa sehlotshwana sa maraba a SNMP. Liketsahalo tse mpe tsa WSA li pheta tlhahisoleseling e tšoanang eo e leng karolo ea leraba le ts'oanang la SNMP.
Bakeng sa liketsahalo tsohle tse romelloang kantle, lintlha tse latelang li fanoe ho meralo ea motheo ea netefatso ea litšebeletso tse se nang mohala (WSA):
- Aterese ea MAC ea AP e khopo
- Lintlha tsa AP e laoloang le seea-le-moea se fumaneng AP e khopo ka RSSI e matla ka ho fetisisa
- Lintlha tse ikhethileng tsa ketsahalo joalo ka SSID, mocha oa ketsahalo e ka bang teng ea pitsa ea mahe a linotsi, le aterese ea MAC ea AP e etsisang ketsahalo ea boikaketsi.
Karolo ea liketsahalo tse mpe tsa WSA e ka nyolohela ho makhetlo a mane ho feta palo e kholo ea li-AP tse tšehetsoeng le halofo ea palo e phahameng ea bareki ba tšehetsoeng.
Karolo ea liketsahalo tse mpe tsa WSA e tšehetsoa ho Cisco DNA Center le lisebelisoa tse ling tsa mokha oa boraro.
Tsamaiso
| Taelo kapa Ketso | Morero | |
| Mohato oa 1 | lokisa terminal ExampLe: Sesebelisoa # lokisa terminal |
E kenya mokhoa oa tlhophiso ea lefats'e. |
| Mohato oa 2 | netweke-tiisetso nolofalletsa ExampLe: Sesebelisoa # sa netefatso ea marang-rang se thusa |
E nolofalletsa tiisetso ea litšebeletso tsa mohala. |
| Mohato oa 3 | waelese wps sekgoahlapi tiisetso ya marangrang nolofalletsa ExampLe: Sesebelisoa sa # wireless wps rogue network-tiisetso e thusa |
E nolofalletsa tiisetso ea litšebeletso tse se nang mohala bakeng sa lisebelisoa tse kotsi. Sena se netefatsa hore diketsahalo tse mpe tsa WSA li romelloa moleng oa liketsahalo. |
Ho beha leihlo Liketsahalo tse Rogue tsa Tiisetso ea Ts'ebeletso ea Waelese
Tsamaiso
- bonts'a lipalo-palo tsa wps tse se nang mohala
ExampLe:
Ho sena mohlalaampLe, liketsahalo tse robong li se li qalile, empa ke tse tšeletseng feela tsa tsona tse latelang. Lebaka ke hobane liketsahalo tse tharo li ile tsa qala pele ho sebelisoa tšobotsi e mpe ea WSA.
- bonts'a lipalo-palo tse se nang mohala tsa wps tse rogue tsa kahare bonts'a li-wireless wps rogue ap rogue-ap-mac-addr
Litaelo tsena li bonts'a tlhahisoleseling e amanang le liketsahalo tsa WSA nalaneng ea ketsahalo.
Litokomane / Lisebelisoa
 |
CISCO Catalyst 9800 Series Wireless Controller Software [pdf] Bukana ea Mosebelisi Catalyst 9800 Series Wireless Controller Software, Catalyst 9800 Series, Wireless Controller Software, Controller Software, Software |
 |
CISCO Catalyst 9800 Series Wireless Controller Software [pdf] Bukana ea Mosebelisi Catalyst 9800 Series Wireless Controller Software, Catalyst 9800 Series, Wireless Controller Software, Controller Software, Software |