topic Re: Air Marshall Collisions with Friendly Wireless APs. - How to co-exist? in Wireless

Air Marshall Collisions with Friendly Wireless APs. - How to co-exist?

nClarity_2023 — Tue, 27 Jun 2023 21:44:28 GMT

We deploy a large number of cellular wireless gateways as part of our IOT solution, which operates on rooftops and outdoor spaces to collect IOT data on building equipment.

We are finding that in some cases, an unknown Air Marshall is shutting down our networks using disassociation packets, causing our wireless clients to constantly disconnect / reconnect.

How can we co-exist with Air Marshalls? How do we find out who they are? I know about white-listing, but that means you need to know who is running the air marshall and contact them.

What about hidden networks? e.g. if we deploy in a hidden fashion, will the Air Marshall still detect them and shut us down?

Re: Air Marshall Collisions with Friendly Wireless APs. - How to co-exist?

Raphael_L — Tue, 27 Jun 2023 23:00:24 GMT

Hi ,

Is it set to 'Allow clients to connect to rogue SSIDs by default' ?

That feature is borderline illegal almost everywhere in the world anyway

Re: Air Marshall Collisions with Friendly Wireless APs. - How to co-exist?

nClarity_2023 — Tue, 27 Jun 2023 23:21:59 GMT

In our situation, we have cellular wifi gateways with a predefined SSID. Our IOT clients have a predefined SSID to connect to the cellular gateway. What we observe is that a neighboring Meraki Air Marshall takes us down. We've made no attempt to connect to the Air Marshall's host network. We have no defense against the Air Marshall (or so it seems)

I'm wondering if we "stay hidden" if the Air Marshall will detect us.

Re: Air Marshall Collisions with Friendly Wireless APs. - How to co-exist?

aleabrahao — Tue, 27 Jun 2023 23:54:36 GMT

In that case there is nothing to do but try to find out who your neighbor is and try to talk to him.

Good luck.

Re: Air Marshall Collisions with Friendly Wireless APs. - How to co-exist?

Brash — Wed, 28 Jun 2023 00:23:43 GMT

Merkai AP's can only perform Air Marshal containment (disassociating clients attempting to join a wireless network) if it detects a rogue AP connected on the same wired network - see image below.

Reference: https://documentation.meraki.com/MR/Monitoring_and_Reporting/Air_Marshal#Overview_of_Air_Marshal_Containment

Other vendors may implement Air Marshalling differently.

To better understand your problem, do you have Meraki AP's on your network?
Of if it's someone elses AP's, how did you verify that they are Meraki AP's that are performing the containment?

Re: Air Marshall Collisions with Friendly Wireless APs. - How to co-exist?

Philip D'Ath — Wed, 28 Jun 2023 04:32:29 GMT

Does the WiFi side have a PSK?

Re: Air Marshall Collisions with Friendly Wireless APs. - How to co-exist?

Madhan kumar G — Wed, 28 Jun 2023 05:43:30 GMT

Hi,

Please let us know how you arrived at the conclusion that AirMarshal is causing the problem.

A proper Survey using Ekahau tools or other spectrum analyzer tools will give you an idea about the interference caused by other sources.

https://www.ekahau.com/blog/identifying-wi-fi-interference-with-ekahau-analyzer/

Also, Your AP signals should be interfering at high RSSI levels to your neighbor devices for them to take action on your network. Are you that much physically close to your neighboring APs.

Re: Air Marshall Collisions with Friendly Wireless APs. - How to co-exist?

nClarity_2023 — Wed, 28 Jun 2023 14:16:14 GMT

Hello, thanks for responding. The IOT client has a PSK. The client also "retries" automatically if it does not achieve an internet connection.

Re: Air Marshall Collisions with Friendly Wireless APs. - How to co-exist?

nClarity_2023 — Wed, 28 Jun 2023 14:22:12 GMT

We do not have a Meraki deployed in our field network. The issue is that our Cradlepoint networks are being attacked by Meraki Air Marshalls. In one case, we sent a message to the building IT team about the issue, indicating that we suspected an Air Marshall, and they whitelisted us in their Air Marshall configuration.

The problem instantly disappeared. The question is though, why did the Air Marshall start shutting our network down, even though our SSID is a friendly neighbor? As we deploy across thousands of sites, this issue will grow.

Re: Air Marshall Collisions with Friendly Wireless APs. - How to co-exist?

nClarity_2023 — Wed, 28 Jun 2023 14:24:13 GMT

Hello, thanks for responding. Here is the behavior we see in our Cradlepoint cellular gateway logs:

The clients are constantly kicked off the gateway.

Re: Air Marshall Collisions with Friendly Wireless APs. - How to co-exist?

aleabrahao — Wed, 28 Jun 2023 15:10:06 GMT

There is nothing we can do for you.

You need to try find your neighborhood by your self.

Re: Air Marshall Collisions with Friendly Wireless APs. - How to co-exist?

nClarity_2023 — Wed, 28 Jun 2023 17:02:12 GMT

Here is the Air Marshall configuration warning that states that the Air Marshall can shut down neighboring WiFi deployments.

"Warning: Care should be taken when configuring SSID block list policies as these policies will apply to SSIDs seen on the LAN as well as off of the LAN from neighboring WiFi deployments. Containment can have legal implications when launched against neighbor networks, and it may harm your own network by increasing channel utilization and potential disrupt clients connecting to your APs. Ensure that the rogue device is within your network and poses a security risk before you launch the containment.
Review the section Overview of Air Marshal Containment to understand how the APs may block the configured SSIDs."

https://documentation.meraki.com/MR/Monitoring_and_Reporting/Air_Marshal#Overview_of_Air_Marshal_Containment

Re: Air Marshall Collisions with Friendly Wireless APs. - How to co-exist?

Philip D'Ath — Wed, 28 Jun 2023 18:41:50 GMT

Note that while Cisco Meraki WiFi has this capability, it is not the only WiFi solution that can do this.

https://www.arubanetworks.com/techdocs/Instant_41_Mobile/Advanced/Content/UG_files/IDS/ConfiguringWIP.htm?TocPath=Intrusion%20Detection%20System%7C$$$$$3

https://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/112045-handling-rogue-cuwn-00.html

You could also simply be experiencing a disassociation attack or someone running a honey pot attack to try and steal data. Are there any APs that are not yours broadcasting the same SSID as what you are using?

Your best defence against all these issues is to use 802.11w (protected management frames) and make sure all your devices also support this. If you don't, the magnitude of your problem will grow as your rollout gets bigger.

Re: Air Marshall Collisions with Friendly Wireless APs. - How to co-exist?

nClarity_2023 — Thu, 29 Jun 2023 01:54:35 GMT

Thanks for the good advice and guidance re: 802.11w.

Re: Air Marshall Collisions with Friendly Wireless APs. - How to co-exist?

danjns — Thu, 29 Jun 2023 11:43:48 GMT

If you use MFP (802.11w) you won't get de-authed

Re: Air Marshall Collisions with Friendly Wireless APs. - How to co-exist?

nClarity_2023 — Thu, 29 Jun 2023 14:13:15 GMT

Can anyone advise if the Air Marshall will detect hidden networks?

Re: Air Marshall Collisions with Friendly Wireless APs. - How to co-exist?

danjns — Thu, 29 Jun 2023 14:16:33 GMT

Yes. Also, never use a hidden network on 5 GHz. Clients will struggle as they can’t probe on a DFS channel