A company wants to turn on Wireless IDS/IPS infrastructure and client detection at the high level on HPE Aruba Networking APs. The company does not want to enable any prevention settings. What should you explain about HPE Aruba Networking recommendations?

HPE Aruba Networking's best practice for deploying Wireless IDS/IPS is to avoid excessive false positives and alert fatigue, which are common when using a generic "high" detection level. The "high" profile enables a large number of signatures, some of which may not be relevant or may be overly sensitive for a specific environment. The recommended approach is to use a "custom" profile. This allows an administrator to start with the "high" profile as a baseline and then selectively disable or tune individual intrusion detection signatures that are generating false positives, tailoring the system to the unique characteristics of the network.

A. Enabling prevention, especially with a "high" detection level, is not recommended without a prior tuning and observation period, as it can lead to denial-of-service for legitimate users.
B. The choice between hybrid APs and dedicated Air Monitors (AMs) is a network design decision based on coverage and capacity needs, not a prerequisite for using detection without prevention.
C. Infrastructure and client detection are distinct categories that monitor for different types of threats. Disabling client detection would leave the network blind to client-centric attacks.

1. ArubaOS 8.10.0.0 User Guide:

Reference: Chapter "Wireless Intrusion Protection"

Section "Configuring IDS Profiles".

Details: This section details the configuration of IDS profiles

including the ids-profile detection-level [custom | high | low | medium | off] command. The existence of the custom level is specifically to allow administrators to fine-tune the detection settings beyond the predefined levels. The guide states

"The custom option allows you to select a detection level

then manually enable or disable individual intrusion detection and protection options." This supports the recommendation to customize settings to fit the environment

which is the essence of option D. (Page 1338)

2. Aruba Campus Wireless Networks Validated Reference Design (VRD) for ArubaOS 8.8:

Reference: Chapter 11: "Security"

Section "Wireless Intrusion Prevention".

Details: While not a direct quote

the methodology described in Aruba VRDs consistently emphasizes a phased deployment approach for security features like WIPS. The process involves enabling detection

monitoring the events

and then tuning the profiles to eliminate false positives before enabling any active prevention. This methodology directly supports creating a custom profile to tune the settings from a baseline like "high". This aligns perfectly with the recommendation in option D.