topic Rogue AP in Wireless

Rogue AP

hs08 — Thu, 06 Feb 2025 00:47:25 GMT

In the WLC we can contain the Rouge AP, but how we can make sure our AP is not contained by neighbor WLC if the my AP located not to far with neighbor AP?

Re: Rogue AP

Haydn Andrews — Thu, 06 Feb 2025 01:25:48 GMT

To start off containment is technically illegal in most countries, unless the rogue is connected to your network or broadcasting your SSID to be malicious.

You would see aWIPS events of Deauthentication Flood, but you need Catalyst Center for aWIPS. That being said you would see clients being dropped from your network as containment will send clients connecting to it deauthentication frames.

Easiest way to protect is to run MFP as mandatory

https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-5/config-guide/b_wl_17_5_cg/m_awips.html

Re: Rogue AP

Rich R — Tue, 18 Mar 2025 14:50:37 GMT

> how we can make sure our AP is not contained by neighbor WLC
You cannot control how the other WLC is configured, but if they break the law (illegal containment) you can report them to the regulator for regulatory enforcement (but a friendly chat with your neighbours might be the better option). But like @Haydn Andrews says using MFP ensures that spoof de-auth frames (which is how containment is done) cannot be used.
https://en.wikipedia.org/wiki/IEEE_802.11w-2009
https://techsearch.watchguard.com/KB?type=Article&SFDCID=kA10H000000bqRZSAY&lang=en_US