H3C Access Controllers
Comware 7 Signature-Based Attack Detection
Configuration Example

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

 

Contents

Overview·· 1

Prerequisites· 1

Example: Configuring signature-based attack detection· 1

Network configuration· 1

Procedures· 2

Configuring basic features on the AC· 2

Configuring a signature· 2

Configuring a signature policy· 2

Configuring a VSD·· 3

Enabling WIPS· 3

Verifying the configuration· 4

Related documentation· 4

 

Overview

The following information provides an example for configuring signature-based attack detection.

Prerequisites

The following information applies to Comware 7-based access controllers. Procedures and information in the examples might be slightly different depending on the software or hardware version of the H3C access controllers.

The configuration examples were created and verified in a lab environment, and all the devices were started with the factory default configuration. When you are working on a live network, make sure you understand the potential impact of every command on your network.

The following information is provided based on the assumption that you have basic knowledge of WIPS and WLAN access.

Example: Configuring signature-based attack detection

Network configuration

As shown in Figure 1, AP 1 and AP 2 provide wireless services for clients through SSID abc. Enable WIPS for the sensor and configure a signature to enable WIPS to trigger an alarm when it detects beacon frames whose SSIDs are not abc.

Figure 1 Network diagram

 

Procedures

Configuring basic features on the AC

Configure wireless service, IP address, AP access, and radio settings. (Details not shown.)

Configuring a signature

1.     Click the Network View tab at the bottom of the page.

2.     From the navigation pane, select Wireless Configuration > Wireless Security.

3.     Click the Add button  to add a signature.

a.     Enter 1 in the Rule ID field.

b.     Select Management from the Frame type list.

c.     Select Beacon from the Frame subtype list.

d.     Enter abc in the SSID field.

e.     Select Not equal from the SSID match type list.

f.     Click Apply.

Figure 2 Adding a signature

 

Configuring a signature policy

1.     Click the Network View tab at the bottom of the page.

2.     From the navigation pane, select Wireless Configuration > Wireless Security.

3.     Click the Add button  to add a signature policy.

a.     Enter sig1 in the Policy name field.

b.     Select 1 from the Signature rule list.

c.     Click Apply.

Figure 3 Adding a signature policy

 

Configuring a VSD

1.     Click the Network View tab at the bottom of the page.

2.     From the navigation pane, select Wireless Configuration > Wireless Security.

3.     Click the Add button  to add a VSD.

a.     Enter VSD_1 in the VSD name field.

b.     Select sig1 from the Signature policy list.

c.     Click Apply.

Figure 4 Adding a VSD

 

Enabling WIPS

1.     Click the Network View tab at the bottom of the page.

2.     From the navigation pane, select Wireless Configuration > Wireless Security.

3.     Click the More button  to enable WIPS.

a.     On the page that opens, select sensor and click the Edit button  to edit the sensor.

b.     On the page that opens, select a radio band from the Radio list and select a VSD from the VSD name list.

c.     Click Apply.

Figure 5 Enabling WIPS

 

 

Verifying the configuration

1.     Click the Network View tab at the bottom of the page.

2.     From the navigation pane, select Monitoring > Network Security, and view the relevant information shown in the Attack statistics area.

Related documentation

H3C Access Controllers Web-Based Configuration Guide