Cisco Adaptive wIPS Deployment Guide, Cisco Unified Wireless Network Version 7.4
Available Languages
Table Of Contents
Cisco Adaptive wIPS Deployment Guide, Cisco Unified Wireless Network Version 7.4
Cisco Adaptive wIPS Introduction
Cisco Adaptive wIPS System Architecture
Component Functions in an Adaptive Wireless IPS Deployment
On-Channel vs. Off-Channel Scanning per wIPS Mode
wIPS Configuration and Profile Management
How Many wIPS Access Points do I need?
Location of wIPS Access Points
Access Point Density Recommendations
wIPS Integrated in a Cisco Unified Wireless Network
Licensing and Ordering Information
Mobility Services Engine Setup
Configuring Access Points for Enhanced Local Mode
Configuring Access Points for wIPS Monitor Mode
Configuring Access Points for AP3600 Local mode plus the WSSI Module
Disabling Controller-based IDS
Cisco Adaptive wIPS Deployment Guide, Cisco Unified Wireless Network Version 7.4
First Published: Month Day, Year-<required>Last Updated: Month Day, Year-<optional, only required when a document is revised>Cisco wIPS Solution Overview
Cisco wIPS solution offers flexible and scalable, 24x7x365-based full time wireless security solution to meet each customer's needs. This document will cover the wIPS security solutions that are provided as part of Cisco Unified Wireless Solution. Depending on your deployment, there is a solution to meet your security needs, starting with the base Wireless LAN Controller (WLC), followed by the WLC and MSE, and finally the WLC, MSE, and CleanAir enabled access points. These three solutions are compared below.
On-wire Attacks
An Access Point in wIPS-optimized mode will perform rogue threat assessment and mitigation using the same logic as current Cisco Unified Wireless Network implementations. This allows a wIPS access point to scan, detect and contain rogue access points and ad-hoc networks. Once discovered, this information regarding rogue wireless devices is reported to PI where rogue alarm aggregation takes place. However, with this functionality comes the caveat that if a containment attack is launched using a wIPS mode access point, its ability to perform methodical attack-focused channel scanning is interrupted for the duration of the containment.
Over-the-Air Attacks
Cisco Adaptive Wireless IPS embeds complete wireless threat detection and mitigation into the wireless network infrastructure to deliver the industry's most comprehensive, accurate and operationally cost-effective wireless security solution. Below are the Over-the-Air attacks that are detected by the Cisco Adaptive wIPS solution.
Non-802.11 Threats
Cisco CleanAir® technology is an effective tool to monitor and manage your network's RF conditions. The Cisco MSE extends those capabilities. The figure below shows the advantages of deploying CleanAir enable Access points with a Cisco Adaptive wIPS solution.
Cisco Adaptive wIPS Introduction
While the complete Cisco wIPS solution is included in the introduction, this document will focus on all aspects of the Over-the-Air wIPS detection. This document will go into detail on:
•
Adaptive wIPS components / architecture
•
•
•
•
•
•
•
•
•
Cisco Adaptive wIPS System Architecture
This document will address the wIPS solution for Over-the-Air Attacks. Cisco's Adaptive Wireless Intrusion Prevention System (wIPS) is made up of a number of components that work together to provide a unified security monitoring solution. In addition to the WLAN Controllers, Access Points and Prime Infrastructure components that currently comprise Cisco's Unified Wireless Networking solution; the wIPS portion introduces two additional components. These additional hardware components include Access Points in wIPS mode and the Mobility Services Engine running the wIPS service software.
Component Functions in an Adaptive Wireless IPS Deployment
•
•
•
•
•
•
•
•
wIPS Deployment Modes
Beginning with the 7.4 release, Cisco Adaptive Wireless IPS has three options for wIPS mode access points. To better understand the differences between the wIPS mode access points, lets discuss each mode.
Enhanced Local Mode (ELM)
Enhanced local mode (ELM) provides wIPS detection "on-channel", which means attackers will be detected on the channel that is serving clients. For all other channels, ELM provides best effort wIPS detection. This means that every frame the radio would go "off-channel" for a short period of time. While "off-channel", if an attack occurs while that channel is scanned, the attack will be detected.
An example of enhanced local mode on an AP3600, the 2.4GHz radio is operating on channel 6. The AP will constantly monitor channel 6, any attacks on channel 6 will be detected and reported. If an attacker attacks channel 11, while the AP is scanning channel 11 "off-channel", the attack will be detected.
The features of ELM are:
•
•
•
•
•
•
•
•
•
•
Monitor Mode
Monitor Mode provides wIPS detection "off-channel", which means the access point will dwell on each channel for an extend period of time, this allows the AP to detect attacks on all channels. The 2.4GHz radio will scan all 2.4GHz channels, while the 5GHz channel scans all 5GHz channels. An additional access point would need to be installed for client access.
Some of the features of Monitor Mode are:
•
•
•
AP3600 with WSSI Module: The Evolution of Wireless Security and Spectrum
A Cisco 3600 series Access point with the WSSI module uses a combination of "on-channel" and "off-channel". This means that the AP3600 2.4GHz and 5GHz will scan the channel that they are serving clients and the WSSI module would operate in monitor mode and scan all channels.
Some of the features of the WSSI Module are:
•
•
•
On-Channel vs. Off-Channel Scanning per wIPS Mode
The figure below explains the radio's behavior. When a radio is on its serving channel it is considered "on-channel", when the radio is scanning other channels, it is considered "off-channel".
An AP in local mode is mostly "on-channel", making it difficult to detect attackers "off-channel". A monitor mode AP is always "off-channel", but cannot server clients, the WSSI module provides a great combination of both.
wIPS Communication Protocols
To provide communication between each system component, a number of protocols are utilized:
•
•
–
•
–
•
wIPS Configuration and Profile Management
Configuration of wIPS Profiles follows a chained hierarchy starting with PI, which is used for profile viewing and modification. The actual profiles are stored within the wIPS service running on the MSE. From the wIPS Service on the MSE, profiles are propagated to specific controllers, which in turn communicate this profile transparently to wIPS Mode Access Points associated to that perspective controller. When a configuration change to a wIPS profile is made at PI and applied to a set of Mobility Services Engine(s) and Controller(s), the following steps occur to put the change in place:
1.
2.
3.
Note
4.
5.
It should be noted that a Mobility Services Engine can only be configured from one Prime Infrastructure. This is essentially a 1:1 relationship meaning that a Mobility Services Engine, once associated to a particular PI, cannot be added to another PI.
wIPS Alarm Flow
The Adaptive wIPS system follows a linear chain of communication to propagate attack information obtained from scanning the airwaves to the console of the Prime Infrastructure.
1.
2.
3.
4.
5.
Deployment Considerations:
Required Components
The basic system components for a Cisco Adaptive wIPS system include:
•
•
•
•
The minimum code versions required for an Adaptive wIPS system:
•
•
•
•
•
The minimum code versions required for the Wireless Security and Spectrum Intelligence Module:
•
•
•
System Scalability
A Mobility Services Engine can be managed only by one Prime Infrastructure, which has design implications when scaling the network. It is possible to have multiple Mobility Services Engines managed by a single Prime Infrastructure.
Use the following scalability facts when designing a system:
•
•
Note
•
How Many wIPS Access Points do I need?
Before deploying an Adaptive wIPS system, it's important to consider that the communications range of an access point's cell is less than the actual range at which frames may be received and decoded. The reason for this discrepancy is that an Access Point's communication range is limited by the weakest link - which in typical deployments is the WLAN client. Given that the output power of a WLAN client is intrinsically less than the Access Point's maximum, the range of the cell is restricted to the client's abilities. In addition, it is recommended practice to run Access Points at less than full power to build RF redundancy and load balancing into the wireless network. These aforementioned fact combined with the superior receive sensitivity of Cisco's Access Points allows the Adaptive wIPS system to be deployed with less access point density than the client serving infrastructure while still providing pervasive monitoring.
As depicted in the above diagram, a wIPS deployment is based on hearing 802.11 management and control frames which are used by a majority of attacks to cause harm. This is in contrast to a data Access Points deployment which is surveyed to provide higher throughput data rates anywhere from 24Mbps to 54Mbps.
There are numerous factors that go into deciding exactly the number of wIPS Access Points that are required for a specific environment. Given that each prospective deployment's security requirements and environmental conditions are different, there is no hard and fast rule that will address the needs of every deployment but a few generalized guidelines must be taken into account.
The main factors, which affect the number of wIPS Access Points required, are as follows.
Deployment Conditions
Deployment-specific environmental conditions such as floor layout and building materials. Given that wireless signal propagation is heavily dependent on the type of material the signal must pass through, an office environment with numerous walls will require more sensors than an empty warehouse. This factor is similar to pre-existing knowledge as to how data-serving Access Points are deployed. The more obstacles in the environment which cause RF signal attenuation, the denser the deployment of wIPS Access Points will need to be.
In the below diagram, an open indoor environment is depicted where wIPS Access Points are deployed with the ability to `listen' for attacks for a long distance given that there are no walls to disrupt or weaken a wireless signal.
In sharp contrast, the diagram below depicts an indoor environment with numerous heavy walls, which cause signal attenuation. In this case, more wIPS Access Points will need to be deployed to ensure that attacks are picked up.
Frequency Band(s) Monitored
The radio frequency propagation characteristics of the 2.4GHz and 5GHz bands vary as a result of the wavelength differences between the two. Put simply, 2.4GHz wireless signals (802.11b/g/n) travel a further distance than 5GHz (802.11a/n). In order to accurately compute the number of wIPS access points needed for a prospective installation, one must consider what frequency bands must be monitored in the wIPS deployment.
Data Rate
Walled Indoor
Open Indoor
6Mbps @ -86dBm
~ 35,000 sqft
~ 85,000 sqft
6Mbps @ -86dBm
~ 10,668 sqm
~ 25,908 sqm
Data Rate
Walled Indoor
Open Indoor
6Mbps @ -86dBm
~ 15,000 sqft
~ 85,000 sqft
6Mbps @ -86dBm
~ 4,572 sqm
~ 25,908 sqm
The above charts outline the circular square footage than can be covered by a single wIPS mode Access Point in each frequency band and each type of environment. These metrics can provide a baseline as how many wIPS Access Points are needed to cover a specific floor area. These charts were created using MatLab simulation software assuming an attacking device outputting 15dBm of transmit power. The receive sensitivity used this calculation represents the lowest common denominator between Cisco's line of Access Points that support wIPS.
Location of wIPS Access Points
The physical deployment of wIPS Mode Access Points is based on the end goal of providing pervasive monitoring across the entire WLAN infrastructure. To this end, wIPS mode APs are placed using two general guidelines. First, deploy wIPS access points around the periphery of your physical location to ensure adequate monitoring of attacks being launched from outside the building. This does not mean that wIPS mode Access Points should be deployed in the physical extremities of the building but instead they should be appropriately positioned to provide detection coverage to the extremities. Second, deploy wIPS access points throughout the center of the building to ensure complete detection of attacks launched from within the physical building.
The physical mounting location of a wIPS Access Point should be based on the same best practices used when mounting data serving Access Points. Following these conventions, it's important that wIPS Access Point antennas are not hidden behind heavy building materials or placed above drop ceilings. In the case that an Access Point is mounted above the ceiling, specific external antennas should be used to bring antenna leads into the same physical space that will be monitored.
In the above deployment example, four wIPS Access Points are deployed around the edges of the building to provide security monitoring around the periphery of the physical building. In addition, a wIPS Access Point is deployed in the center of the building to provide security-monitoring coverage inside the building.
Access Point Density Recommendations
As stated above, the square footage of access point coverage can be measured based on frequency and environment, but with the newer wIPS modes, other factors also contribute to wIPS access point density recommendations. All access point modes can monitor the same distance, but due to the reasons below, it is recommended to deploy each mode with a different density.
wIPS Enhanced local mode Access Point are geared towards serving clients. For enhanced local mode deployments, it is recommended for every access point be put in enhanced local mode.
For monitor mode access points, we recommend that a ratio of 1:5 local mode to monitor mode access points.
Finally for the WSSI module, there is a single radio monitoring all channels on both the 2.4GHz and 5GHz band. Since radio has additional channels to scan, it is recommended that the WSSI module be deployed with a 2:5 density to speed up detection time.
wIPS Integrated in a Cisco Unified Wireless Network
An integrated wIPS deployment is a system design in which non-wIPS Mode Access Points and wIPS Mode Access Points are intermixed on the same controller(s) and managed by the same Prime Infrastructure. This can be any combination of local mode, flex connect mode, enhanced local mode, monitor mode, and 3600 series Access points with the WSSI module. Overlaying wIPS protection and data shares many of the components including controllers and Prime Infrastructure thus reducing duplicate infrastructure costs.
Forensics
Cisco's Adaptive wIPS system provides the ability to capture attack forensics for further investigation and troubleshooting purposes. At a base level, the forensics capability is a toggle-based packet capture facility, which provides the ability to log and retrieve a set of wireless frames. This feature is enabled on a per attack basis from within the wIPS profile configuration of PI.
Once enabled, the forensics feature is triggered once a specific attack alarm is seen over the airwaves. The forensic file will be created based on the packets contained within the buffer of the wIPS Mode AP that triggered the original alarm. This file is transferred to the Wireless LAN Controller via CAPWAP, which then forwards the forensic file via NMSP to the wIPS Service running on the Mobility Services Engine. The file is stored within the forensic archive on the MSE until the user configured disk space limit for forensics is reached. By default this limit is 20Gigabytes, which when reached will cause the oldest forensic files to be removed. Access to the forensic file can be obtained by opening the alarm on the Prime Infrastructure, which contains a hyperlink to the forensic file. The files are stored as a `.CAP' file format which can be opened by either WildPacket's Omnipeek, AirMagnet WiFi Analyzer, Wireshark or any other packet capture program which supports this format. Wireshark is available at http://www.wireshark.org.
Note
Licensing and Ordering Information
Cisco Adaptive wIPS is a licensed software feature set on the Cisco Mobility Services Engine. The table below shows the license levels available for Adaptive wIPS
Note
Ordering Support
For MSE hardware appliance orders, Cisco SMARTnet® Service includes both hardware and license support. Select the appropriate level of hardware support under the Cisco SMARTnet Service program for the Cisco MSE hardware appliances. Use the following SKU:
•
For MSE Virtual Appliance orders, use the following SKU for both software and license support:
•
Adaptive wIPS Configuration
Mobility Services Engine Setup
To setup the mobility services engine:
Step 1
Login with the following credentials: root/password
Step 2
Upon the initial boot up, the MSE will prompt the administrator to launch the setup script. Enter yes to this prompt.
Note
Step 3
Step 4
When prompted for eth1 interface parameters, enter `Skip' to proceed to the next step as a second NIC is not required for operation.
Note
Step 5
Enabled High Availability, then select the role of the MSE. Then select the Ethernet port that will be actively monitored by a secondary MSE server. If there is a direct connection, the Ethernet port must be given.
Now provide a Virtual IP address for this HA pair. Once a Virtual IP address is given, you can being the HA exchange by starting HA Recovery mode.
Step 6
Only one DNS server is required for successful domain resolution, enter backup servers for resiliency.
Step 7
If the default time zone of New York is not applicable to your environment, browse through the location menus to set it correctly.
Step 8
This can be skipped.
Step 9
Configure the IP address of your remote Syslog Server.
Then provide the log message priority level and facility.
Step 10
NTP is optional but ensures your system maintains an accurate system time. If you select No you will be prompted to set the current time for the system.
Note
Step 11
This allows the user to configure an audit daemon. This step can be skipped.
Step 12
A login banner is used to inform users of the system's use and present a warning to keep unauthorized users from accessing the system. Since the login banner may be a multi-line message, a single period (.) ends the message and proceeds to the next step.
Step 13
This parameter is used to enable/disable local console access to the system. This should be enabled so local troubleshooting can occur.
Step 14
This parameter is used to enable/disable remote console access to the system. This should be enabled so remote troubleshooting can occur however corporate security policies may mandate disabling this option.
Step 15
This step is critical in ensuring system security, be sure to pick a strong password consisting of letters and numbers with no dictionary words. The minimum password length is 8 characters.
Step 16
These configuration parameters are not required and the default setting is to skip them by entering `s'.
Step 17
This configuration parameter is not required and the default setting is to skip it by entering `s'. (This step is optional).
Step 18
Step 19
Once the setup script has completed, save your changes when prompted. After saving, follow the prompts to reboot the MSE as well to ensure all settings are applied successfully.
Step 20
Login to the MSE using the username root and password previously configured in step 13. Execute the command service msed start to start the MSE service.
Step 21
Execute the command: chkconfig msed on
Adding the MSE to PI
To add MSE to PI:
Step 1
Login to PI and click Mobility Services Engine from the Design drop-down menu.
Step 2
From the drop down on the right hand side, select Add Mobility Services Engine and click Go
Enter a unique device name for the MSE, the IP address previously configured during the MSE setup, a contact name for support and the PI Communication Password configured during the MSE setup. Do not change the username from the default of admin.
Step 3
Add your MSE license here.
Step 4
Step 5
From the Design drop-down menu, select Synchronize Services
Step 6
Select the Controllers tab, to see a list of controllers. Once the desired controllers are selected, press the Change MSE Assignment button.
A popup will be displayed with a list of controllers to synchronize the MSE with. Select the desired features for synchronization and click.
Configuring Access Points for Enhanced Local Mode
Any local mode indoor access point can be configured in enhanced local mode.
To configure access points for enhanced local mode:
Step 1
a.
b.
c.
d.
e.
f.
Repeat this for each Access Point that has been configured into Enhanced Local Mode.
Configuring Access Points for wIPS Monitor Mode
Any indoor access point can be configured in wIPS monitor mode.
To configure access points for wIPS monitor mode:
Step 1
a.
b.
c.
d.
e.
f.
Repeat this for each Access Point that has been configured into wIPS Monitor Mode.
Configuring Access Points for AP3600 Local mode plus the WSSI Module
This mode is only available for a 3600 series Access Point with a WSSI module installed.
To configure access points for AP3600 local mode plus the WSSI module:
Step 1
Enter the Access Point configuration menu in PI via Operate > Device Group > Device Type > Unified AP and click on the Access Point's name, then Configuration.
a.
b.
c.
d.
e.
f.
Configuring wIPS Profiles
By default, the MSE and corresponding wIPS Access Points inherit the default wIPS profile from PI. This profile comes pre-tuned with a majority of attack alarms enabled by default and will monitor attacks against Access Points within the same RF-Group as the wIPS Access Points. In this manner, the system comes pre-setup to monitor attacks against a deployment model that utilizes an integrated solution in which both the WLAN infrastructure and wIPS Access Points are intermixed on the same controller.
Note
To configure wIPS profiles:
Step 1
From the top-level PI menu, click Design > Configuration > Wireless Configuration > wIPS Profiles
Step 2
Click Profile List on the left hand side.
Select Add Profile from the upper right-hand drop down menu.
Step 3
Cisco's Adaptive wIPS system comes with a pre-defined set of profile templates of which customers can use as a starting place to create their own custom profiles. Each one is tailored to a specific vertical and varies in regards to which specific alarms are enabled.
After selecting a profile and providing a name, click Save and Edit
Step 4
By default, the system monitors attacks launched against the local Wireless LAN Infrastructure (as defined by APs which have the same `RF Group' name). If the system should also be required to monitor attacks against another network, such as when deployed in an overlay deployment model, the SSID groups feature must be utilized.
If this step is not required, simply click Next.
Check the box next to MyWLAN and select Edit Group from the drop down in the upper right hand corner then click Go.
Step 5
Once again, this step is only required if the system is to be utilized to monitor attacks against a different WLAN infrastructure which is typical of an overlay deployment model.
Enter the SSID(s) (separated by a single space if there are more than one) and click Save
The SSID Groups page will now look like the following screen shot, confirming the SSID(s) were added successfully.
Click Next
Step 6
This configuration screen allows specific attacks to be enabled or disabled. It also permits the administrator to drill down to specific alarms and edit their specific thresholds or even turn on forensics.
To enable or disable alarms, simply click the box next to the specific alarm in question.
To edit the policy parameters, click on an alarm, which modifies the right hand frame to represent the point configuration of that attack.
Step 7
Once a specific alarm is selected, the policy rules associated to that alarm can be modified.
To edit a policy rule, check the box next to the rule and click Edit
The policy rule window allows the severity of the alarm to be modified in addition to a number of other parameters. The notification item is a check box which defines whether forensic (packet captures) are taken for this particular alarm. There is also a specific threshold for this alarm, which in this case is defined as the number of active associations but this is different for every alarm. Next, the type parameter defines what WLAN infrastructure the system will monitor attacks against. By default this is configured to Device Group and Internal which specifies all APs in the same `RF Group' name as the wIPS APs. Changing the type to SSID allows the system to monitor a separate network, which is typical of an overlay deployment and this configuration is discussed below.
Step 8
Editing a policy rule would typically only be needed in an overlay deployment where the system is to be configured to monitor another WLAN infrastructure by SSID.
To add a policy rule, click Add
The policy rule window allows the severity of the alarm to be modified in addition to a number of other parameters. The notification item is a check box which defines whether forensic (packet captures) are taken for this particular alarm. There is also a specific threshold for this alarm, which in this case is defined as the number of active associations but this is different for every alarm. Next, the type parameter defines what SSIDs the system will monitor. If the type is changed to `Device Group' then the system will monitor attacks only against APs in the same `RF Group'. In the case that `SSID' is selected, then the system can be utilized to monitor attacks against a separate WLAN infrastructure as defined by the SSID Groups earlier in the setup.
After any changes have been made, click Save
Step 9
If the system is to be configured to monitor another WLAN infrastructure by SSID, then changes will need to be made for each and every policy rule to monitor by SSID. A policy rule will need to created under each separate alarm which defines the system to monitor attacks against the SSID Group created earlier.
Step 10
After any changes are made, click Save to save the profile on Prime Infrastructure and then click Next when done.
Step 11
Select the MSE/Controller combinations to apply the profile to and then click Apply.
Disabling Controller-based IDS
Once the Adaptive wIPS system has been pervasively installed across the entire area to be monitored, it is recommended that Cisco's traditional Wireless LAN Controller IDS be disabled. Executing this step prevents duplicate alerts being triggered on both the Adaptive wIPS and existing IDS systems.
To disable controller-based IDS:
Step 1
Step 2
Step 3
Step 4
Feedback