Configuring Vendor Specific IE Exclusion

HPE Aruba Networking Central allows users to configure exclusions for IDS Intrusion Detection System. IDS monitors a network or systems for malicious activity or policy violations and reports its findings to the management system deployed in the network. containment based on vendor-specific IE information. This feature allows APs to be exempted from containment even when the devices use randomized MAC Media Access Control. A MAC address is a unique identifier assigned to network interfaces for communications on a network. addresses.

To exempt APs from containment, users should configure the vendor OUI Organizationally Unique Identifier. Synonymous with company ID or vendor ID, an OUI is a 24-bit, globally unique assigned number, referenced by various standards. The first half of a MAC address is OUI. and OUI type in the IDS unauthorized device profile. A maximum of five vendor OUI and OUI types can be defined for confinement exclusion.

To define vendor OUI and OUI type for confinement exclusion, complete the following steps:

  1. In the WebUI, create a template group from the Groups page under Maintain > Organization page.
    For more information on creating template groups, see Creating a Template Group.
  2. Set the filter to the newly created group.
  3. Under Manage, click Devices > Access Points.
  4. Click the Config icon.

    The tabs to configure the APs are displayed.

  5. Click + in the Templates page.

    The Add template window is displayed.

  6. In the Basic Info page, enter the Template Name. You could optionally select the model and version of the APs.

  7. Click Next.

    The Template Configuration page is displayed.

  8. Configure the vendor specific IE exclusions under ids using the vendor-specific-ie-exclusion <oui> <oui_type> command.
    The following example shows a sample vendor specific IE exclusion template. Template groups allow you to configure multiple IE exclusions under IDS.

    9. ids

    wireless-containment deauth-only

    infrastructure-detection-level custom

    infrastructure-protection-level custom

    vendor-specific-ie-exclusion 00:03:7F 1

    vendor-specific-ie-exclusion AA:BB:CC 123

    vendor-specific-ie-exclusion 00:11:22 21

  9. Save the template.