cancel
Showing results for 
Search instead for 
Did you mean: 

ZD1200 : a question about temporary block wireless client with repeated authen for xx second.

hyosang_choi
Valued Contributor
Hello.

We want to know about temporary block wireless client with repeated authentication for XX second.

Image_ images_messages_5f91c3f9135b77e24790462f_4f0ab4eaee9ddaaaeb9e92019d6681cf_RackMultipart2019122667875vrzo-40447dc0-b352-404b-9fe7-76024c7c2994-7705759.PNG1577329232

Q1. How long is the interval and what number of hit is it?
ex. if it repeated x times in y mins, block for Z sec.

Q2. If someone was blocked for 30 seconds, does it show under block client list like below? 
Image_ images_messages_5f91c3f9135b77e24790462f_e807463ffc8da0825e3c79ef71e89836_RackMultipart20191226104469fj5-23425e32-ba36-4ea9-b7f3-dbfd5e21540f-749414462.PNG1577329568

I couldn't find documents about it anywhere.

Please let me know about it.

Thanks in advance.

5 REPLIES 5

pradeep_kumar_h
New Contributor II
Hi Jeronimo,

If this capability is activated, any clients that repeatedly fail in attempting authentication will be temporarily blocked for a period of time (10~1200 seconds, default is 30). Clients temporarily blocked by the Intrusion Prevention feature are not added to the Blocked Clients list on the Services & Profiles > Access Control page, Blocked Clients section.

For repeated authentication failure blocking feature, if ZD detects station authentication failures more than 5 times, there will be an event log entry. If it is more than 10 times and if the temp block is enabled, this station will be blocked for 30 seconds. After the block is lifted, the counter is reset. Auth failure includes failed shared key auth failure, 802.1x/WPA auth failures.

This info is available in ZD User Guide and in Knowledgebase article
User Guide:https://support.ruckuswireless.com/documents/2906-zonedirector-10-3-ga-user-guide
KB Article: https://support.ruckuswireless.com/articles/000003500

Regards,
Pradeep

hyosang_choi
Valued Contributor
Hello Pradeep.

Thanks for prompt reply very much.

I didn't still have an answer about a interval form your reply.

But from a document, it seems that interval is 300sec.
 Image_ images_messages_5f91c449135b77e247a04f4d_b62bd64ed0b3dd9bd17e9a02bed6a86c_RackMultipart2019122698784jdoi-39315c5a-312e-4b14-9489-f5dcae07cc89-709460813.PNG1577333280

Is it right?

Regards.





Yes.

Thanks.

Your answer is very helpful for me.