Isolating Rogue APs
One of the important features to turn on in a mobile-first deployment is the ability of the switches to detect and
quarantine rogue access points. Administrators would like to prevent unauthorized access to their networks and a
rogue AP can open up the network to unwanted users and traffic.
The Rogue AP Isolation feature detects and blocks any unauthorized APs in the network. You can either log or
block the rogue device. If the action requested is to log the rogue device, the MAC address of the rogue device is
logged in the system logs (RMON). If the action is to block the rogue device, the traffic to and from the MAC
address of the rogue device is blocked. The MAC is also logged in the system log.
When an Aruba AP detects a rogue AP on the network, it sends out the MAC address of the AP as well as the
MAC of the clients connected to the AP to the switch using the ArubaOS-Switch proprietary LLDP TLV protocol.
The switch then adds a rule in its hardware table to block all the traffic originating from the rogue AP’s MAC
address.
The
rogue-ap-isolation
command configures the rogue AP isolation for the switch and gives the option to
enable or disable the rogue AP isolation feature. The
rogue-ap-isolation action
command gives you the
ability to block the traffic to or from the rogue device or log the MAC of the rogue device. When the action is set to
block, the rogue MAC is logged as well. By default, the action is set to block.
The
rogue-ap-isolation whitelist
command lets you add devices detected as possible rogue APs to the
whitelist. A maximum of 128 MAC addresses are supported for the whitelist.
The
clear rogue-aps
command clears the detected rogue AP device MAC address.
Using the Rogue AP Isolation feature
Procedure
1.
Check the feature state:
switch#
show rogue-ap-isolation
Rogue AP Isolation
Rogue AP Status : Disabled
Rogue AP Action : Block
Rogue MAC Address Neighbour MAC Address
----------------- ---------------------
2.
Enable the feature:
switch#
rogue-ap-isolation enable
switch#
show rogue-ap-isolation
Rogue AP Isolation
Rogue AP Status : Enabled
Rogue AP Action : Block
Rogue MAC Address Neighbour MAC Address
----------------- ---------------------
3.
Change the action type from block to log:
switch#
rogue-ap-isolation action log
switch#
show rogue-ap-isolation
724
Aruba 2930F / 2930M Management and Configuration Guide
for ArubaOS-Switch 16.08
