Jamey Heary of the Network World Cisco Subnet blog discusses the benefits of the Cisco IPS' ability to request wireless access points disconnect offenders when malicious traffic is detected. Is this something many people use? Or is this a "feature" masking the need for better IPS capabilities needed in WAPs compared to the Layer 2 IPS built into most wireless access points? Seems like a poor substitute for designing an IPS implementation that addresses coverage of wireless traffic.
Unless it's very finely tuned, this is likely to generate lots of calls to the help desk line. Kicking users off the network completely, wireless or not, when an IPS finds some offending traffic is likely to create more cry wolf events than thwarting real attacks. Blocking packets and stateful sessions is much more the norm. Seems like one of those features you'd try out and then very quickly turn off after a few false alarms.
Blocking offending packets or quarantining users with limited access is likely the better solution. But maybe I'm wrong and am missing something here. I would be very interested to hear if any Cisco IPS and WAP customers use this feature and what their experiences have been.
Please email me with your experiences if you would. Thanks.
Comments