topic Re: Rogue AP Policies and Best Practices in Wireless

Rogue AP Policies and Best Practices

DarioPouseiro — Tue, 27 Jun 2023 09:26:30 GMT

Dear Cisco Community,

I am trying to undesrtand the best practices and the best policies to deal with Rogue APs, and many doubts emerged. Let me just clarify that I am just a beginer.

Under Rogue Policies on the Wireless Controller, the AP Authentication, If I select that option is just to confirm what kind of authentication the rogue AP is using when a new one is detected?

When I receive a rogue AP minor alarm, and I identify that it is a harmless Wi-fi access point from a business around the building, what happens if I classify it as friendly? It is a security flaw if I do it? In the future, if that WAP becomes dangerous, how would I identify it? A new alert would be reported if for example the SSID was changed?

Thank you in advance!

Best regards!

Re: Rogue AP Policies and Best Practices

Flavio Miranda — Tue, 27 Jun 2023 12:27:49 GMT

AP Authentication is related to your Access Point, not the rogues. With that feature, you can create authentication for your APs, similar to clients. Sounds like a good idea but can create a lot of problem. I would not recommend.

"When I receive a rogue AP minor alarm, and I identify that it is a harmless Wi-fi access point from a business around the building, what happens if I classify it as friendly? "

The alarm will not be generated again. If you do not classify as frendly I will be receiving alarms about that AP all the time.

"It is a security flaw if I do it?

I dont believe so.

"In the future, if that WAP becomes dangerous, how would I identify it? A new alert would be reported if for example the SSID was changed?"

The only possibility I can see for that AP to become "Dangerous" would be if the AP´s owner start advertising your SSIDs or start the containement for your SSIDs. And this could be identify through others logs also.

Re: Rogue AP Policies and Best Practices

Haydn Andrews — Tue, 27 Jun 2023 22:14:31 GMT

Generally I set the rules like this:
Rogue detected with my SSIDs - classify as malicious

Rogue detected with signal -85 - Classify Neigbour and dont worry

Rogue detected on wire - classify malicous

Rogue detected with signal better than -75 then have investigated.

Containement should only be done if the rogue is broadcasting your SSIDs, or is on your wired network - there are legal considerations to containment (https://edition.cnn.com/2014/10/03/travel/marriott-fcc-wi-fi-fine/index.html)
Also with containment it affects your APs so it should only be done whilst you are physically finding and disconnecting the rogue AP