5-82
Cisco Wireless LAN Controller Configuration Guide
OL-17037-01
Chapter 5 Configuring Security Solutions
Managing Rogue Devices
When the controller receives a rogue report from one of its managed access points, it responds as
follows:
1.
The controller verifies that the unknown access point is in the friendly MAC address list. If it is, the
controller classifies the access point as Friendly.
2.
If the unknown access point is not in the friendly MAC address list, the controller starts applying
rogue classification rules.
3.
If the rogue is already classified as Malicious, Alert or Friendly, Internal or External, the controller
does not reclassify it automatically. If the rogue is classified differently, the controller reclassifies it
automatically only if the rogue is in the Alert state.
4.
The controller applies the first rule based on priority. If the rogue access point matches the criteria
specified by the rule, the controller classifies the rogue according to the classification type
configured for the rule.
5.
If the rogue access point does not match any of the configured rules, the controller classifies the
rogue as Unclassified.
6.
The controller repeats the previous steps for all rogue access points.
7.
If RLDP determines that the rogue access point is on the network, the controller marks the rogue
state as Threat and classifies it as Malicious automatically, even if no rules are configured. You can
then manually contain the rogue (unless you have configured RLDP to automatically contain the
rogue), which would change the rogue state to Contained. If the rogue access point is not on the
network, the controller marks the rogue state as Alert, and you can manually contain the rogue.
8.
If desired, you can manually move the access point to a different classification type and rogue state.
shows the rogue states that can be adopted by a rogue access point in a particular classification
type.
Table 5-8
Classification Mapping
Rule-Based Classification Type
Rogue States
Friendly
•
Internal—If the unknown access point is inside the network and
poses no threat to WLAN security, you would manually
configure it as Friendly, Internal. For example, the access
points in your lab network.
•
External—If the unknown access point is outside the network
and poses no threat to WLAN security, you would manually
configure it as Friendly, External. For example, the access
points belonging to a neighboring coffee shop.
•
Alert—The unknown access point is moved to Alert if it is not
in the neighbor list or in the user-configured friendly MAC list.
Malicious
•
Alert—The unknown access point is moved to Alert if it is not
in the neighbor list or in the user-configured friendly MAC list.
•
Threat—The unknown access point is found to be on the
network and poses a threat to WLAN security.
•
Contained—The unknown access point is contained.
•
Contained Pending—The unknown access point is marked
Contained, but the action is delayed due to unavailable
resources.
