SonicWALL TZ 190 Manuale Utente

Rogue Access Points have emerged as one of the most serious and insidious threats to 
wireless security. In general terms, an access point is considered rogue when it has not been 
authorized for use on a network. The convenience, affordability and availability of non-secure 
access points, and the ease with which they can be added to a network creates a easy 
environment for introducing rogue access points. Specifically, the real threat emerges in a 
number of different ways, including unintentional and unwitting connections to the rogue 
device, transmission of sensitive data over non-secure channels, and unwanted access to LAN 
resources. So while this doesn't represent a deficiency in the security of a specific wireless 
device, it is a weakness to the overall security of wireless networks.

The security appliance can alleviate this weakness by recognizing rogue access points 
potentially attempting to gain access to your network. It accomplishes this in two ways: active 
scanning for access points on all 802.11a and 802.11g channels, and passive scanning (while 
in Access Point mode) for beaconing access points on a single channel of operation.

Check Enable Rogue Access Point Detection to enable the security appliance to search for 
rogue access points. 

The Authorized Access Points list determines which access points the security appliance will 
considered authorized when it performs a scan. You can select All Authorized Access Points 
to allow all SonicPoints, or you can select an address object group containing a group of MAC 
address to limit the list to only those SonicPoints whose MAC addresses are contained in the 
address object group. 

Select Create Address Object Group to add a new group of MAC address objects to the list. 

See 

 for instructions on creating 

address objects and address object groups.

Active scanning occurs when the security appliance starts up, and at any time Scan All is 
clicked on the SonicPoint > IDS page. When the security appliance performs a scan, a 
temporary interruption of wireless clients occurs for no more than a few seconds. This 
interruption manifests itself as follows: 

Non-persistent, stateless protocols (such as HTTP) should not exhibit any ill-effects.

Persistent connections (protocols such as FTP) are impaired or severed.

WiFiSec connections should automatically re-establish and resume with no noticeable 
interruption to the client. 

If service disruption is a concern, it is recommended that the Scan Now feature not be used 
while the SonicWALL security appliance is in Access Point mode until such a time that no 
clients are active, or the potential for disruption becomes acceptable.

You can also scan on a SonicPoint by SonicPoint basis by choosing from the following options 
in the Perform SonicWALL Scan menu on the header for the individual SonicPoint:

Scan Both Radios

Scan 802.11a Radio (5GHz)

Scan 802.11g Radio (2.4GHZ)