1-20
Cisco Wireless LAN Controller Configuration Guide
OL-9141-03
Chapter 1 Overview
Rogue Access Points
•
Determine the closest authorized access point, making directed scans faster and more effective.
•
Contain rogue access points by sending their clients deauthenticate and disassociate messages from
one to four lightweight access points. This containment can be done for individual rogue access
points by MAC address, or can be mandated for all rogue access points connected to the enterprise
subnet.
•
Tag rogue access points:
–
Acknowledge rogue access point when they are outside of the LAN and do not compromise the
LAN or wireless LAN security.
–
Accept rogue access point when they do not compromise the LAN or wireless LAN security.
–
Tag rogue access point as unknown until they are eliminated or acknowledged.
–
Tag rogue access point as contained and discourage clients from associating with the rogue
access point by having between one and four lightweight access points transmit deauthenticate
and disassociate messages to all rogue access point clients. This function contains all active
channels on the same rogue access point.
Rogue Detector mode detects whether or not a rogue access point is on a trusted network. It does not
provide RF service of any kind, but rather receives periodic rogue access point reports from the
controller, and sniffs all ARP packets. If it finds a match between an ARP request and a MAC address it
receives from the controller, it generates a rogue access point alert to the controller.
To facilitate automated rogue access point detection in a crowded RF space, lightweight access points
can be configured to operate in monitor mode, allowing monitoring without creating unnecessary
interference.
