Network Management

Hello,

I have a client who is currently running a POC with a controller and several APs in monitor mode. His goal is to build a dedicated WIPS/IDS system, comprised of dual  controllers and several hundreds Active Monitors. No WiFi access is planned.

His question is this: in this specific environment, will Airwave bring any additional value over the controller functionality? It seems that all the rogue AP/client detection and notification mechanisms are already covered by the controller software; Airwave appears to be redundant in that area.

Can anyone please share his opinion on this matter?

Thanks a lot,

Yuly

Airwave offers considerable abilities with WIP with its RAPIDS module.  Click on the RAPIDS tab within Airwave and then click on Help.

Thanks, but unfortunately I do not have a system by my side. My question is more about the differences between the build-in controller WIPS capabilities (with RFProtect) and the RAPIDS of Airwave.

Thanks a gain,

Yuly

I do not have a document that specifically spells out the difference between Airwave and Controller-based WIPS.  The link to the Airwave documentation is here:  http://support.arubanetworks.com/DOCUMENTATION/tabid/77/DMXModule/512/Command/Core_Download/Default.aspx?EntryId=8543

Please look under the RAPIDs section in that document.

The easiest way to think about the differences is that AirWave has a hard drive and will give you long term data storage.  The controller does not.

There are lots of other subtle differences.  AirWave can poll routers/switches for bridge forwarding data and ARP data allowing you to find out more information about rogue devices.  AirWave has much more flexible rules for device classification.  AirWave has additional triggers and reports to keep your network secure.  I would strongly recommend using AirWave in a high security environment like you have described.