SonicOS 7.1 Access Points

Advanced IDP > Configuring Wireless IDP Settings
Table of Contents

Configuring Wireless IDP Settings

To configure Wireless IDP settings

  1. Navigate to the DEVICE | Access Points > Advanced IDP page.

  2. Select Enable Wireless Intrusion Detection and Prevention to enable the appliance to search for rogue access points, including KRACK Man-in-the-Middle access points. This option is not selected by default, so when selected, the other options become active.

    All detected access points are displayed in the Discovered Access Points table on the DEVICE | Access Points > IDS page, and you can authorize any allowed access points.

  3. For Authorized Access Points, select the Address Object Group to which authorized Access Points are assigned. By default, this is set to All Authorized Access Points.

    For SonicPoint Ns, no access point mode Virtual Access Point (VAP) is created. One station mode VAP is created, which is used to do IDS scans, and to connect to and send probes to unsecured access points.

  4. For Rogue Access Points, select the Address Object Group to which unauthorized Access Points are assigned. By default, this is set to All Rogue Access Points.

  5. Select one of the following two options to determine which access points are considered rogue (only one can be enabled at a time):

    • Add any unauthorized AP into Rogue AP list automatically assigns all detected unauthorized access points—regardless if they are connected to your network—to the Rogue list.
    • Add connected unauthorized AP into Rogue AP list assigns unauthorized devices to the Rogue list only if they are connected to your network. The following options determine how IDP detects connected rogue devices; both can be selected:
      • Enable ARP cache search to detect connected rogue AP – Advanced IDP searches the ARP cache for clients’ MAC addresses. When one is found and the AP it is connected to is not authorized, the AP is classified as rogue.
      • Enable active probe to detect connected rogue AP – The SonicPoint/SonicWave connects to the suspect device and sends probes to all LAN, DMZ and WLAN interfaces of the firewall. If the firewall receives any of these probes, the AP is classified as rogue.
  6. Select Add evil twin into Rogue AP list to add devices to the rogue list when they are not in the authorized list, but have the same SSID as a managed access point.

  7. Select Block traffic from rogue AP and its associated clients to drop all incoming traffic that has a source IP address that matches the rogue list. From the Rogue Device IP addresses drop-down menu, either:

    • Select All Rogue Devices (default) or an address object group you have created.
    • Create a new address object group by selecting Create New IP Address Object Group. The Add Address Object Group window displays.
  8. Select Disassociate rogue AP and its clients to send de-authentication messages to clients of a rogue device to stop communication between them.
  9. Select Disassociate Client from KRACK MITM AP to enable the KRACK prevention function. When enabled, the SonicWave periodically checks for KRACK Man-in-the-Middle access points and actively disassociates the client from the KRACK MITM access point when it detects a client associated to it.
  10. Click Accept to save your changes.