PC Professionell 2007 April/PCpro_2007_04.ISO/files/dsl/ManageEngineWiFiManager.exe/Disk1/data1.cab/SourceFiles/WiFiManager.exe/WLANCustomExpert.xml

Extensible Markup Language | 2007-01-17 | 36.7 KB | 1,013 lines

<?xml version="1.0"?>
<expert-list>
    <!-- Generic entry for any kind of Alerts -->


    <expert>
        <id>0</id>
        <severity>6</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <name>Unknown Alert</name>
        <class>Others</class>
        <summary>Unknown Alert</summary>
        <description><![CDATA[<p>Unknown Alert.</p>]]></description>
        <action></action>
        <customprotect>1</customprotect>
        <alarmsbypoll>0</alarmsbypoll>
        <pollingname></pollingname>
        <isthreshold>0</isthreshold>
    </expert>


    <!-- Security policies
    id 6000 : Httpd disabled, 6001:WEP Enforced, 6002:WEP key length,6003: BroadcastSSID Disabled,6004:Telnet Disabled
    6005:PSPF Disabled,6006:EAP Enforced
    -->
    <expert>
        <id>6006</id>
        <severity>2</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <name>EAP Disabled</name>
        <class>Vulnerability</class>
        <summary>Network-level EAP authentication is disabled </summary>
        <description><![CDATA[ <p>EAP authentication is disabled for this Access Point. It is advisable to use EAP-based authentication. EAP has several advantages than the conventional WEP encryption. Moreover, with AccessPoints that don't use EAP or other powerful authentication mechanisms, rogue clients can easily get access to the network.</p>    ]]></description>
        <action><![CDATA[Enable EAP or other powerful authentication mechanisms in the AccessPoint]]></action>
        <detailsurl> <![CDATA[/fault/ShowAlarmDetails.do?uri=/webclient/fault/html/vulnerability-eap-disabled.html]]></detailsurl>
        <customprotect>1</customprotect>
        <alarmsbypoll>1</alarmsbypoll>
        <pollingname>EAP Disabled</pollingname>
        <isthreshold>0</isthreshold>
        <clearmsg>Network-level EAP authentication is now enabled</clearmsg>
    </expert>
    <!-- Security policies ends here -->



    <!-- SNMP Reachability start from id=7000 to id=7009
    id 7000 : SNMP Reachability for AP, 7001:SNMP Reachability for Switch, 7002:SNMP Reachability for Router,7003:SNMP Reachability for Server
    -->
    <expert>
        <id>7000</id>
        <severity>4</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <name>SNMP Reachability for AccessPoint</name>
        <class>Availability</class>
        <summary>AccessPoint's SNMP Reachability</summary>
        <description><![CDATA[ <p>This alert reports the SNMP reachability status of the Access Point.</p>]]></description>
        <action><![CDATA[
            <p>On the event of service down
                <ul>
                    <li>Restart the SNMP service in the device.</li>
                    <li>Check whether the device's community string matches with what is set in the WiFiManager's global credentials.</li>
                </ul>
            </p>

            ]]></action>
        <groupName>Service Availability</groupName>
        <customprotect>1</customprotect>
        <alarmsbypoll>0</alarmsbypoll>
        <pollingname></pollingname>
        <isthreshold>0</isthreshold>
    </expert>


    <expert>
        <id>7001</id>
        <severity>4</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <name>SNMP Reachability for Switch</name>
        <class>Availability</class>
        <summary>Switch's SNMP Reachability</summary>
        <description><![CDATA[ <p>This alert reports the SNMP reachability status of the Switch </p>]]></description>
        <action><![CDATA[
            <p>
                On the event of service down
                <ul>
                    <li>Restart the SNMP service in the device.</li>
                    <li>Check whether the device's community string matches with what is set in the WiFiManager's global credentials.</li>
                </ul>
            </p>

            ]]></action>
        <groupName>Service Availability</groupName>
        <customprotect>1</customprotect>
        <alarmsbypoll>0</alarmsbypoll>
        <pollingname></pollingname>
        <isthreshold>0</isthreshold>
    </expert>


    <expert>
        <id>7002</id>
        <severity>4</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <name>SNMP Reachability for Router</name>
        <class>Availability</class>
        <summary>Router's SNMP Reachability Status</summary>
        <description><![CDATA[ <p>This alert reports the SNMP reachability status of the Router</p>]]></description>
        <action><![CDATA[
            <p>
                On the event of service down
                <ul>
                    <li>Restart the SNMP service in the device.</li>
                    <li>Check whether the device's community string matches with what is set in the WiFiManager's global credentials.</li>
                </ul>
            </p>

            ]]></action>
        <groupName>Service Availability</groupName>
        <customprotect>1</customprotect>
        <alarmsbypoll>0</alarmsbypoll>
        <pollingname></pollingname>
        <isthreshold>0</isthreshold>
    </expert>


    <expert>
        <id>7005</id>
        <severity>4</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <name>SNMP Reachability for Gateway</name>
        <class>Availability</class>
        <summary>SNMP Reachability fails for Gateway</summary>
        <description><![CDATA[ <p>This alert reports the SNMP reachability status of the Gateway</p>]]></description>
        <action><![CDATA[
            <p>
                On the event of service down
                <ul>
                    <li>Restart the SNMP service in the device.</li>
                    <li>Check whether the device's community string matches with what is set in the WiFiManager's global credentials.</li>
                </ul>
            </p>

            ]]></action>

        <groupName>Service Availability</groupName>
        <customprotect>1</customprotect>
        <alarmsbypoll>0</alarmsbypoll>
        <isthreshold>0</isthreshold>
    </expert>


    <expert>
        <id>7006</id>
        <severity>4</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <name>SNMP Reachability for Sensor</name>
        <class>Availability</class>
        <summary>SNMP Reachability fails for Sensor</summary>
        <description><![CDATA[ <p>This alert reports the SNMP reachability status of the Sensor</p>]]></description>
        <action></action>
        <groupName>Service Availability</groupName>
        <customprotect>1</customprotect>
        <alarmsbypoll>0</alarmsbypoll>
        <isthreshold>0</isthreshold>
    </expert>


    <expert>
        <id>7007</id>
        <severity>4</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <name>SNMP Reachability for AAA Server</name>
        <class>Availability</class>
        <summary>SNMP Reachability fails for AAA Server</summary>
        <description><![CDATA[ <p>This alert reports the SNMP reachability status of the AAA Server</p>]]></description>
        <action><![CDATA[
            <p>
                On the event of service down
                <ul>
                    <li>Restart the SNMP service in the device.</li>
                    <li>Check whether the device's community string matches with what is set in the WiFiManager's global credentials.</li>
                </ul>
            </p>

            ]]></action>

        <groupName>Service Availability</groupName>
        <customprotect>1</customprotect>
        <alarmsbypoll>0</alarmsbypoll>
        <isthreshold>0</isthreshold>
    </expert>

    <!--SNMP Reachability ends here -->


    <expert>
        <id>7100</id>
        <severity>4</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <name>Telnet Reachability for AccessPoint</name>
        <class>Availability</class>
        <summary>AccessPoint's Telnet Reachability</summary>
        <description><![CDATA[ <p>This alert reports the Telnet reachability status of the Access Point.</p>]]></description>
        <action><![CDATA[
            <p>On the event of service down
                <ul>
                    <li>Restart the Telnet service in the device.</li>
                    <li>Check whether the device's telnet credentials matches with what is set in the WiFiManager's global credentials.</li>
                </ul>
            </p>
            ]]></action>
        <groupName>Service Availability</groupName>
        <customprotect>1</customprotect>
        <alarmsbypoll>0</alarmsbypoll>
        <pollingname></pollingname>
        <isthreshold>0</isthreshold>
    </expert>


    <!-- Device Availability start from id=7200 to id=7209
    id 7200 : Device Reachability for AP, 7201:SNMP Reachability for Switch, 7202:SNMP Reachability for Router,7203:SNMP Reachability for Server
    -->
    <expert>
        <id>7200</id>
        <severity>1</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <name>Reachability for AccessPoint</name>
        <class>Availability</class>
        <summary>AccessPoint not reachable</summary>
        <description><![CDATA[ <p>This alert reports the reachability status of the Device</p>]]></description>
        <action></action>
        <groupName>Device Availability</groupName>
        <customprotect>1</customprotect>
        <alarmsbypoll>1</alarmsbypoll>
        <pollingname>WLANAPObjectStatusPoll</pollingname>
        <isthreshold>0</isthreshold>
    </expert>


    <expert>
        <id>7201</id>
        <severity>1</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <name>Reachability for Switch</name>
        <class>Availability</class>
        <summary>Switch not reachable</summary>
        <description><![CDATA[ <p>This alert reports the Reachability status of the Device</p>]]></description>
        <action></action>
        <groupName>Device Availability</groupName>
        <customprotect>1</customprotect>
        <alarmsbypoll>1</alarmsbypoll>
        <pollingname>OpManagerSwitchObjectStatusPoll</pollingname>
        <isthreshold>0</isthreshold>
    </expert>


    <expert>
        <id>7202</id>
        <severity>1</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <name>Reachability for Router</name>
        <class>Availability</class>
        <summary>Router not reachable</summary>
        <description><![CDATA[ <p>This alert reports the reachability status of the Device</p>]]></description>
        <action></action>
        <groupName>Device Availability</groupName>
        <customprotect>1</customprotect>
        <alarmsbypoll>1</alarmsbypoll>
        <pollingname>OpManagerRouterObjectStatusPoll</pollingname>
        <isthreshold>0</isthreshold>
    </expert>


    <expert>
        <id>7205</id>
        <severity>1</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <name>Reachability for Sensor</name>
        <class>Availability</class>
        <summary>Sensor not reachable</summary>
        <description><![CDATA[ <p>This alert reports the reachability status of the Device</p>]]></description>
        <action></action>
        <groupName>Device Availability</groupName>
        <customprotect>1</customprotect>
        <alarmsbypoll>1</alarmsbypoll>
        <pollingname>OpManagerSensorObjectStatusPoll</pollingname>
        <isthreshold>0</isthreshold>
    </expert>


    <expert>
        <id>7207</id>
        <severity>1</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <name>Reachability for AAA Server</name>
        <class>Availability</class>
        <summary>AAA Server not reachable</summary>
        <description><![CDATA[ <p>This alert reports the reachability status of the Device</p>]]></description>
        <action></action>
        <groupName>Device Availability</groupName>
        <customprotect>1</customprotect>
        <alarmsbypoll>1</alarmsbypoll>
        <pollingname>AAAServerStatusPoll</pollingname>
        <isthreshold>0</isthreshold>
    </expert>


    <expert>
        <id>7208</id>
        <severity>1</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <name>Reachability for Gateway</name>
        <class>Availability</class>
        <summary>Gateway not reachable</summary>
        <description><![CDATA[ <p>This alert reports the reachability status of the Device</p>]]></description>
        <action></action>
        <groupName>Device Availability</groupName>
        <customprotect>1</customprotect>
        <alarmsbypoll>1</alarmsbypoll>
        <pollingname>GatewayStatusPoll</pollingname>
        <isthreshold>0</isthreshold>
    </expert>

    <!--Device Reachability ends here -->


    <!-- Router Interfaces Reachability id=:Reachability for Switch -->
    <expert>
        <id>7301</id>
        <severity>1</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <name>Interface Reachability for Routers</name>
        <class>Availability</class>
        <summary>Interfaces Reachability fails for Routers</summary>
        <description><![CDATA[ <p>This alert reports reachability status of Router's Interface</p>]]></description>
        <action></action>
        <customprotect>1</customprotect>
        <alarmsbypoll>0</alarmsbypoll>
        <pollingname></pollingname>
        <isthreshold>0</isthreshold>
    </expert>


    <!--Router Interface Reachability ends here -->

    <!-- Switch Port Reachability id=7004:Port Reachability for Switch -->
    <expert>
        <id>7302</id>
        <severity>1</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <name>Port Reachability for Switch</name>
        <class>Availability</class>
        <summary>Port Reachability fails for Switch </summary>
        <description><![CDATA[ <p>This alert is generated whenever the Switch's Port is down</p>]]></description>
        <action></action>
        <customprotect>1</customprotect>
        <alarmsbypoll>0</alarmsbypoll>
        <pollingname>OpManagerSwitchObjectStatusPoll</pollingname>
        <isthreshold>0</isthreshold>
    </expert>

    <!--Switch Port  Reachability ends here -->


    <!-- RF Port Status Poller id=7004:Port Reachability for Switch -->
    <expert>
        <id>7304</id>
        <severity>1</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <name>RF Port Status for AccessPoint</name>
        <class>Availability</class>
        <summary>RF Port Status Poller for AccessPoint</summary>
        <description><![CDATA[ <p>This alert reports the RF Port's Status of the AccessPoint</p>]]></description>
        <action></action>
        <customprotect>1</customprotect>
        <alarmsbypoll>0</alarmsbypoll>
        <pollingname></pollingname>
        <isthreshold>0</isthreshold>
    </expert>

    <!-- RF Port Status Poller ends here -->

    <!--Ethernet Port Status for AP id 7305 -->
    <expert>
        <id>7305</id>
        <severity>1</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <name>Ethernet Port Status for AccessPoint</name>
        <class>Availability</class>
        <summary>Ethernet Port Status for AccessPoint </summary>
        <description><![CDATA[ <p>This alert reports the Ethernet Port's Status of the AccessPoint </p>]]></description>
        <action></action>
        <customprotect>1</customprotect>
        <alarmsbypoll>0</alarmsbypoll>
        <pollingname></pollingname>
        <isthreshold>0</isthreshold>
    </expert>
    <!--Ethernet Port Status for AP ends here -->


    <!-- In Bandwidth Utilization start from id=7700  to id=7703
    id 7700 : In Bandwidth Utilization for AP, 7701:In Bandwidth Utilization for Switch, 7702:In Bandwidth Utilization for Router, 7703:In Bandwidth Utilization for Server,
    -->
    <expert>
        <id>7701</id>
        <severity>1</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <name>Rx Traffic Utilization for Switch</name>
        <class>Performance</class>
        <summary>In-Bandwidth Utilization for Switch </summary>
        <description><![CDATA[ <p>This alert is generated when the Rx Utilization exceeds the specified threshold limit.</p>]]></description>
        <message>Rx Utilization Exceeded.</message>
        <action></action>
        <groupName>Rx Traffic Utilization</groupName>
        <customprotect>1</customprotect>
        <alarmsbypoll>1</alarmsbypoll>
        <pollingname>InterfaceInUtilizationForSwitch</pollingname>
        <isthreshold>1</isthreshold>
        <thresholdtype>INTEGER</thresholdtype>
        <thresholdvalue>75</thresholdvalue>
        <thresholdname>InterfaceInUtilizationForSwitch</thresholdname>
        <clearmsg>Rx Utilization Normal</clearmsg>
    </expert>


    <expert>
        <id>7702</id>
        <severity>1</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <name>Rx Traffic Utilization for Router</name>
        <class>Performance</class>
        <summary>In-Bandwidth Utilization for Router</summary>
        <description><![CDATA[ <p>This alert is generated when the Rx Utilization exceeds the specified threshold limit.</p>]]></description>
        <message>Rx Utilization Exceeded.</message>
        <action></action>
        <groupName>Rx Traffic Utilization</groupName>
        <customprotect>1</customprotect>
        <alarmsbypoll>1</alarmsbypoll>
        <pollingname>InterfaceInUtilizationForRouter</pollingname>
        <isthreshold>1</isthreshold>
        <thresholdtype>INTEGER</thresholdtype>
        <thresholdvalue>75</thresholdvalue>
        <thresholdname>InterfaceInUtilizationForRouter</thresholdname>
        <clearmsg>Rx Utilization Normal</clearmsg>
    </expert>
    <!-- In Bandwidth Utilization ends here-->



    <!-- Out Bandwidth Utilization start from id=7710  to id=7713
    id 7710 : Out Bandwidth Utilization for AP, 7711:Out Bandwidth Utilization for Switch, 7712:Out Bandwidth Utilization for Router, 7713:Out Bandwidth Utilization for Server,
    -->
    <expert>
        <id>7711</id>
        <severity>1</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <name>Tx Traffic Utilization for Switch</name>
        <class>Performance</class>
        <summary>Out-Bandwidth Utilization for Switch </summary>
        <description><![CDATA[ <p>This alert is generated when the Tx Utilization exceeds the specified threshold limit.</p>]]></description>
        <message>Tx Utilization Exceeded.</message>
        <action></action>
        <groupName>Tx Traffic Utilization</groupName>
        <customprotect>1</customprotect>
        <alarmsbypoll>1</alarmsbypoll>
        <pollingname>InterfaceOutUtilizationForSwitch</pollingname>
        <isthreshold>1</isthreshold>
        <thresholdtype>INTEGER</thresholdtype>
        <thresholdvalue>75</thresholdvalue>
        <thresholdname>InterfaceOutUtilizationForSwitch</thresholdname>
        <clearmsg>Tx Utilization Normal.</clearmsg>
    </expert>


    <expert>
        <id>7712</id>
        <severity>1</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <name>Tx Traffic Utilization for Router</name>
        <class>Performance</class>
        <summary>Out-Bandwidth Utilization for Router</summary>
        <description><![CDATA[ <p>This alert is generated when the Tx Utilization exceeds the specified threshold limit.</p>]]></description>
        <message>Tx Utilization Exceeded.</message>
        <action></action>
        <groupName>Tx Traffic Utilization</groupName>
        <customprotect>1</customprotect>
        <alarmsbypoll>1</alarmsbypoll>
        <pollingname>InterfaceOutUtilizationForRouter</pollingname>
        <isthreshold>1</isthreshold>
        <thresholdtype>INTEGER</thresholdtype>
        <thresholdvalue>75</thresholdvalue>
        <thresholdname>InterfaceOutUtilizationForRouter</thresholdname>
        <clearmsg>Tx Utilization Normal.</clearmsg>
    </expert>


    <expert>
        <id>7714</id>
        <severity>1</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <name>Bandwidth Utilization for AccessPoint</name>
        <class>Performance</class>
        <summary>Bandwidth Utilization for AccessPoint </summary>
        <description><![CDATA[ <p>This alert is generated when the utilization exceeds the specified threshold limit.</p>]]></description>
        <message>Interface Utilization Exceeded.</message>
        <action><![CDATA[ <p>Check whether clients connected to the AccessPoint are genuine. If yes, add more AccessPoints to serve clients.</p>]]></action>
        <groupName>Bandwidth Utilization</groupName>
        <customprotect>1</customprotect>
        <alarmsbypoll>1</alarmsbypoll>
        <pollingname>BandwidthDataCollection</pollingname>
        <isthreshold>1</isthreshold>
        <thresholdtype>INTEGER</thresholdtype>
        <thresholdvalue>75</thresholdvalue>
        <thresholdname>BandwidthDataCollection</thresholdname>
        <clearmsg>Interface Utilization Normal.</clearmsg>
    </expert>

    <!-- Out Bandwidth Utilization ends here-->


    <!-- Transmit and Receive Error For AP Starts here-->

    <expert>
        <id>7715</id>
        <severity>2</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <name>Transmit Error for AccessPoint</name>
        <class>Operational</class>
        <summary>Transmit Error for AccessPoint </summary>
        <description><![CDATA[ <p>This alert is generated when the Transmit Error exceeds the specified threshold limit.</p>]]></description>
        <message>Transmit Errors Exceeded.</message>
        <action></action>
        <groupName>Interface Errors</groupName>
        <customprotect>1</customprotect>
        <alarmsbypoll>1</alarmsbypoll>
        <pollingname>TransmitErrorsForAP</pollingname>
        <isthreshold>1</isthreshold>
        <thresholdtype>INTEGER</thresholdtype>
        <thresholdvalue>500</thresholdvalue>
        <thresholdname>TransmitErrorsForAP</thresholdname>
        <clearmsg>Transmit Errors Receded.</clearmsg>
    </expert>


    <expert>
        <id>7716</id>
        <severity>2</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <name>Recieve Error for AccessPoint</name>
        <class>Operational</class>
        <summary>Recieve Error for AccessPoint </summary>
        <description><![CDATA[ <p>This alert is generated when the Recieve Error exceeds the specified threshold limit.</p>]]></description>
        <message>Recieve Errors Exceeded.</message>
        <action></action>
        <groupName>Interface Errors</groupName>
        <customprotect>1</customprotect>
        <alarmsbypoll>1</alarmsbypoll>
        <pollingname>ReceiveErrorsForAP</pollingname>
        <isthreshold>1</isthreshold>
        <thresholdtype>INTEGER</thresholdtype>
        <thresholdvalue>500</thresholdvalue>
        <thresholdname>ReceiveErrorsForAP</thresholdname>
        <clearmsg>Recieve Errors Receded.</clearmsg>
    </expert>


    <!-- Transmit and Receive Error For AP Ends here-->



    <!-- RF Port Errors id=7500 to 7504 -->
    <!-- RF Port Packet Errors(FCS) id=7500, WEP ICV Errors id = 7501, WEP Undecrypt Error id = 7502, Frame Retries id= 7503   -->
    <expert>
        <id>7500</id>
        <severity>1</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <name>RF Port Packet Errors</name>
        <class>Operational</class>
        <summary>RF Port Packet Errors </summary>
        <description><![CDATA[ <p>This alert is generated when the RF Port Packet Errors exceeds the specified threshold limit.</p>]]></description>
        <message>Packet Errors Exceeded.</message>
        <action></action>
        <groupName>RF Port Errors</groupName>
        <customprotect>1</customprotect>
        <alarmsbypoll>1</alarmsbypoll>
        <pollingname>P802_11APFCSErrorRate</pollingname>
        <isthreshold>1</isthreshold>
        <thresholdtype>INTEGER</thresholdtype>
        <thresholdvalue>400</thresholdvalue>
        <thresholdname>P802_11APFCSErrorRate</thresholdname>
        <clearmsg>Packet Errors Receded.</clearmsg>
    </expert>


    <expert>
        <id>7501</id>
        <severity>1</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <name>RF Port WEP ICV Errors </name>
        <class>Operational</class>
        <summary>RF Port WEP ICV Errors </summary>
        <description><![CDATA[ <p>This alert is generated when the RF Port WEP Errors exceeds the specified threshold limit.</p>]]></description>
        <message>WEP Errors Exceeded.</message>
        <action></action>
        <groupName>RF Port Errors</groupName>
        <customprotect>1</customprotect>
        <alarmsbypoll>1</alarmsbypoll>
        <pollingname>P802_11APWEPICVErrorRate</pollingname>
        <isthreshold>1</isthreshold>
        <thresholdtype>INTEGER</thresholdtype>
        <thresholdvalue>400</thresholdvalue>
        <thresholdname>P802_11APWEPICVErrorRate</thresholdname>
        <clearmsg>WEP Errors Receded.</clearmsg>
    </expert>


    <expert>
        <id>7502</id>
        <severity>1</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <name>RF Port WEP Undecryptable Errors </name>
        <class>Operational</class>
        <summary>RF Port WEP Undecryptable Errors </summary>
        <description><![CDATA[ <p>This alert is generated when the number of undecryptable WEP packets exceeds the specified threshold limit.</p>]]></description>
        <message>Undecryptable WEP Packets Exceeded.</message>
        <action></action>
        <groupName>RF Port Errors</groupName>
        <customprotect>1</customprotect>
        <alarmsbypoll>1</alarmsbypoll>
        <pollingname>P802_11APWEPDecryptErrorRate</pollingname>
        <isthreshold>1</isthreshold>
        <thresholdtype>INTEGER</thresholdtype>
        <thresholdvalue>400</thresholdvalue>
        <thresholdname>P802_11APWEPDecryptErrorRate</thresholdname>
        <clearmsg>Undecryptable WEP Packets Receded.</clearmsg>
    </expert>


    <expert>
        <id>7503</id>
        <severity>1</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <groupName>RF Port Errors</groupName>
        <name>AccessPoint Max Frame Retry Count </name>
        <class>Operational</class>
        <summary>AccessPoint Max Frame Retry Count </summary>
        <description><![CDATA[ <p>This alert is generated when the number of frame retries exceeds the specified threshold limit.</p>]]></description>
        <message>Frame Retries Exceeded.</message>
        <action><![CDATA[ <p>Check for nearby AccessPoints operating in same channel.</p>]]></action>
        <customprotect>1</customprotect>
        <alarmsbypoll>1</alarmsbypoll>
        <pollingname>P802_11APFRRate</pollingname>
        <isthreshold>1</isthreshold>
        <thresholdtype>INTEGER</thresholdtype>
        <thresholdvalue>400</thresholdvalue>
        <thresholdname>P802_11APFRRate</thresholdname>
        <clearmsg>Frame Retries Receded.</clearmsg>
    </expert>

    <!-- Max Retry Count ends here    -->


    <!-- TRAP related alarms-->
    <expert>
        <id>8001</id>
        <severity>3</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <groupName>Traps</groupName>
        <name>802.11 Authentication Failure</name>
        <class>Vulnerability</class>
        <summary>802.11 Authentication Failure </summary>
        <description><![CDATA[ <p>This alarm indicates that 802.11 authentication failed for an access point. This might be due to a rogue client attack or an authentication flood attack. </p>]]></description>
        <action><![CDATA[Check whether the mobile client is genuine.]]></action>
        <customprotect>1</customprotect>
        <alarmsbypoll>0</alarmsbypoll>
        <pollingname></pollingname>
        <isthreshold>0</isthreshold>
    </expert>


    <expert>
        <id>8002</id>
        <severity>3</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <groupName>Traps</groupName>
        <name>Symbol 4131 ACL Violation</name>
        <class>Vulnerability</class>
        <summary>  Symbol 4131 ACL Violation </summary>
        <description><![CDATA[ <p>This alarm indicates that a mobile client which is not in the Access Control List of the AccessPoint is trying to associate with it. This might be a rogue client or it might be an authentication storm attack.</p>]]></description>
        <action><![CDATA[Check whether the mobile client is genuine.]]></action>
        <customprotect>1</customprotect>
        <alarmsbypoll>0</alarmsbypoll>
        <pollingname></pollingname>
        <isthreshold>0</isthreshold>
    </expert>


    <expert>
        <id>8003</id>
        <severity>3</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <groupName>Performance Traps</groupName>
        <name>Symbol 4131 RF Interference</name>
        <class>Performance</class>
        <summary>Symbol 4131 RF Interference</summary>
        <description><![CDATA[ <p>This alarm indicates that the AccessPoint experiences RF interference. This might be due to channel collision between neighboring AccessPoints.</p>]]></description>
        <action><![CDATA[Move neighboring AccessPoints to different channels.]]></action>
        <customprotect>1</customprotect>
        <alarmsbypoll>0</alarmsbypoll>
        <pollingname></pollingname>
        <isthreshold>0</isthreshold>
    </expert>


    <expert>
        <id>8004</id>
        <severity>3</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <groupName>Performance Traps</groupName>
        <name>Symbol 4131 Max Associations</name>
        <class>Performance</class>
        <summary>Symbol 4131 Max Associations</summary>
        <description><![CDATA[ <p>This alarm indicates that the access point has reached the maximum number of associations. Any new association beyond this limit will be dropped the AccessPoint.</p>]]></description>
        <action><![CDATA[Add more access points if this place is thickly populated by mobile clients.]]></action>
        <customprotect>1</customprotect>
        <alarmsbypoll>0</alarmsbypoll>
        <pollingname></pollingname>
        <isthreshold>0</isthreshold>
    </expert>


    <expert>
        <id>8005</id>
        <severity>3</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <groupName>Traps</groupName>
        <name>Symbol 4121 ACL Violation</name>
        <class>Vulnerability</class>
        <summary>Symbol 4121 ACL Violation</summary>
        <description><![CDATA[ <p>This alarm indicates that a mobile client which is not in the Access Control List of the AccessPoint is trying to associate with it. This might be a rogue client or it might be an authentication storm attack.</p>]]></description>
        <action><![CDATA[Check whether the mobile client is genuine.]]></action>
        <customprotect>1</customprotect>
        <alarmsbypoll>0</alarmsbypoll>
        <pollingname></pollingname>
        <isthreshold>0</isthreshold>
    </expert>


    <expert>
        <id>8006</id>
        <severity>3</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <groupName>Performance Traps</groupName>
        <name>Symbol 4121 RF Interference</name>
        <class>Performance</class>
        <summary>Symbol 4121 RF Interference</summary>
        <description><![CDATA[ <p>This alarm indicates that the AccessPoint experiences RF interference. This might be due to channel collision between neighboring AccessPoints.</p>]]></description>
        <action><![CDATA[Move neighboring AccessPoints to different channels.]]></action>
        <customprotect>1</customprotect>
        <alarmsbypoll>0</alarmsbypoll>
        <pollingname></pollingname>
        <isthreshold>0</isthreshold>
    </expert>


    <expert>
        <id>8007</id>
        <severity>3</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <groupName>Performance Traps</groupName>
        <name>Symbol 4121 Max Associations</name>
        <class>Performance</class>
        <summary>Symbol 4121 Max Associations</summary>
        <description><![CDATA[ <p>This alarm indicates that the access point has reached the maximum number of associations. Any new association beyond this limit will be dropped the AccessPoint.</p>]]></description>
        <action><![CDATA[Add more access points if this place is thickly populated by mobile clients.]]></action>
        <customprotect>1</customprotect>
        <alarmsbypoll>0</alarmsbypoll>
        <pollingname></pollingname>
        <isthreshold>0</isthreshold>
    </expert>


    <expert>
        <id>8008</id>
        <severity>3</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <groupName>Traps</groupName>
        <name>Symbol 3021 ACL Violation</name>
        <class>Vulnerability</class>
        <summary>Symbol 3021 ACL Violation</summary>
        <description><![CDATA[ <p>This alarm indicates that a mobile client which is not in the Access Control List of the AccessPoint is trying to associate with it. This might be a rogue client or it might be an authentication storm attack.</p>]]></description>
        <action><![CDATA[Check whether the mobile client is genuine.]]></action>
        <customprotect>1</customprotect>
        <alarmsbypoll>0</alarmsbypoll>
        <pollingname></pollingname>
        <isthreshold>0</isthreshold>
    </expert>


    <expert>
        <id>8009</id>
        <severity>3</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <groupName>Performance Traps</groupName>
        <name>Symbol 3021 RF Interference</name>
        <class>Performance</class>
        <summary>Symbol 3021 RF Interference</summary>
        <description><![CDATA[ <p>This alarm indicates that the AccessPoint experiences RF interference. This might be due to channel collision between neighboring AccessPoints.</p>]]></description>
        <action><![CDATA[Move neighboring AccessPoints to different channels.]]></action>
        <customprotect>1</customprotect>
        <alarmsbypoll>0</alarmsbypoll>
        <pollingname></pollingname>
        <isthreshold>0</isthreshold>
    </expert>


    <expert>
        <id>8010</id>
        <severity>3</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <groupName>Traps</groupName>
        <name>Symbol 3021 Max Associations</name>
        <class>Vulnerability</class>
        <summary>Symbol 3021 Max Associations</summary>
        <description><![CDATA[ <p>This alarm indicates that the access point has reached the maximum number of associations. Any new association beyond this limit will be dropped the AccessPoint.</p>]]></description>
        <action><![CDATA[Add more access points if this place is thickly populated by mobile clients.]]></action>
        <customprotect>1</customprotect>
        <alarmsbypoll>0</alarmsbypoll>
        <pollingname></pollingname>
        <isthreshold>0</isthreshold>
    </expert>


    <expert>
        <id>8011</id>
        <severity>3</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <groupName>Performance Traps</groupName>
        <name>Proxim RF Interference</name>
        <class>Performance</class>
        <summary>Proxim RF Interference</summary>
        <description><![CDATA[ <p>This alarm indicates that the AccessPoint experiences RF interference. This might be due to channel collision between neighboring AccessPoints.</p>]]></description>
        <action><![CDATA[Move neighboring AccessPoints to different channels.]]></action>
        <customprotect>1</customprotect>
        <alarmsbypoll>0</alarmsbypoll>
        <pollingname></pollingname>
        <isthreshold>0</isthreshold>
    </expert>


    <expert>
        <id>8012</id>
        <severity>3</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <groupName>Traps</groupName>
        <name>Proxim No Authentication</name>
        <class>Vulnerability</class>
        <summary>Proxim No Authentication</summary>
        <description><![CDATA[ <p>This alarm indicates that the AccessPoint serves Mobile Clients without authenticating them.  This is a serious security threat.</p>]]></description>
        <action><![CDATA[Enable Authentication in the AccessPoint]]></action>
        <customprotect>1</customprotect>
        <alarmsbypoll>0</alarmsbypoll>
        <pollingname></pollingname>
        <isthreshold>0</isthreshold>
    </expert>


    <expert>
        <id>8013</id>
        <severity>3</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <groupName>Traps</groupName>
        <name>Proxim Invalid Encryption</name>
        <class>Vulnerability</class>
        <summary>Proxim Invalid Encryption</summary>
        <description><![CDATA[ <p>This alarm indicates that a mobile client tried to connect to this AccessPoint using an invalid encryption key. This might be an attack.</p>]]></description>
        <action><![CDATA[Check whether the mobile client is genuine.]]></action>
        <customprotect>1</customprotect>
        <alarmsbypoll>0</alarmsbypoll>
        <pollingname></pollingname>
        <isthreshold>0</isthreshold>
    </expert>


    <expert>
        <id>8014</id>
        <severity>3</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <groupName>Traps</groupName>
        <name>Proxim Authentication Failure</name>
        <class>Vulnerability</class>
        <summary>Proxim Authentication Failure</summary>
        <description><![CDATA[ <p>This alarm indicates that a mobile client failed to authenticate with the access point. This might be a rogue client or an attack.</p>]]></description>
        <action><![CDATA[Check whether the mobile client is genuine.]]></action>
        <customprotect>1</customprotect>
        <alarmsbypoll>0</alarmsbypoll>
        <pollingname></pollingname>
        <isthreshold>0</isthreshold>
    </expert>


    <!-- Associated Clients id=7124 -->
    <expert>
        <id>7124</id>
        <severity>1</severity>
        <enabled>1</enabled>
        <frequency>0</frequency>
        <name>Associated Clients</name>
        <class>Operational</class>
        <summary>Associated Clients</summary>
        <description><![CDATA[ <p>This alert is generated when the number of associated mobile users on an access point exceeds the specified threshold limit </p>]]></description>
        <message>Number of associated Mobile Users Exceeded.</message>
        <action><![CDATA[ <p>Check whether clients connected to the AccessPoint are genuine. If yes, add more AccessPoints to serve clients.</p>]]></action>
        <customprotect>1</customprotect>
        <alarmsbypoll>1</alarmsbypoll>
        <pollingname>WLANAPAssociationPoll</pollingname>
        <isthreshold>1</isthreshold>
        <thresholdtype>INTEGER</thresholdtype>
        <thresholdname>WLANAPAssociationPoll</thresholdname>
        <thresholdvalue>20</thresholdvalue>
        <clearmsg>Number of associated Mobile Users Normal.</clearmsg>
    </expert>
    <!-- Associated Clients ends here    -->


    <!-- $Id: WLANCustomExpert.xml,v 1.58 2006/12/06 11:55:44 elumalais Exp $ -->

    <expert>
        <id>4012</id>
        <enabled>1</enabled>
        <name>Rogue MobileUnit Detected</name>
        <severity>2</severity>
        <class>Intrusion</class>
        <frequency>1</frequency>
        <summary>Mobile Unit  with unauthorized MacAddress/Vendor detected</summary>
        <alerttemplate></alerttemplate>
        <description><![CDATA[<p>Client with unauthorized MAC address/Vendor detected. WLAN Administrators can import the list of authorized MAC Address or vendors into WiFi Manager, if the MAC address of the discovered client is not in the authorized MAC list, or if the client device is from a vendor not authorized by the WLAN Administrator, the client is marked as rogue.  Sometimes this client device could also be a new device the MAC Address of which is still not updated in the authorized MAC list. </p>]]></description>
        <detailsurl> <![CDATA[/fault/ShowAlarmDetails.do?uri=/webclient/fault/html/Intrusion-Rogue-Client-detection.html]]></detailsurl>
        <action><![CDATA[<p>Add the MAC to authorized MAC list if the client is legitimate. Marking the client as trusted, from WiFi Manager inventory page, will automatically add the (MAC Address,Vendor) to the authorized list. If it is not a legitimate client, remove it physically or block it from the network by adding its MAC to the blocked list of all the AccessPoint's Access Control List.
        </p>]]></action>
        <clearmsg>Mobile Client added to the trusted list.</clearmsg>
    </expert>


    <expert>
        <id>4011</id>
        <enabled>1</enabled>
        <name>Rogue AccessPoint Detected</name>
        <severity>2</severity>
        <class>Intrusion</class>
        <frequency>1</frequency>
        <summary>AccessPoint with unauthorized MAC address/SSID/Channel/Vendor detected</summary>
        <alerttemplate></alerttemplate>
        <description><![CDATA[<p>A new access point with unauthorized MAC Address/SSID/Channel/Vendor detected. Possible reasons for this alarm are -
                <ul>
                    <li>Installation of a new, legitimate access point, which doesn't satisfy the criteria defined by WLAN Administrator to qualify as trusted."</li>
                    <li>Detection of an AccessPoint in neighboring premises that is not connected to your WLAN.</li>
                    <li>Accidental or intentional connection of a new rogue AccessPointi by an employee.</li>
                    <li>An AccessPoint run by an attacker masquerading as a real AccessPoint.</li>
        </ul></p>]]></description>
        <action><![CDATA[<p>Add the MAC to authorized MAC list if the AP is legitimate. Marking the AccessPoint as trusted will automatically add the MAC to the authorized list.Remove AccessPoint from the network using the block switch port option, if the AccessPoint is truly a rogue AccessPoint.
        </p>]]></action>
        <detailsurl> <![CDATA[/fault/ShowAlarmDetails.do?uri=/webclient/fault/html/Intrusion-Rogue-AP-detection.html]]></detailsurl>
        <clearmsg>Access point added to the trusted list.</clearmsg>
    </expert>


</expert-list>