Rogue AP Alarm in Prime

[Simon Laurendeau]

Hi, I'm working on Prime alarm and I'm wondering how to do this :

1) I would like that all rogue AP not containing a substring to be friendly

2) I would like that all rogue AP containing that substring malicious.

Is it possible ? I can't seem to figure out how the Rogue AP rules works...

Thanks,

Simon Laurendeau

[Rasika Nayanajith · Accepted solution]

Hi Simon,

It should be possible, Have a look on below what I did sometime back, may be useful to you on this

http://mrncciew.com/2013/06/02/rogue-classification/

HTH

Rasika

**** Pls rate all useful responses ****

[Simon Laurendeau]

Very good article!

Do you know if wildcards are possible in the SSID name ?

Edit : Seems that I would need to upgrade to 7.5 for wildcards :S

[Rasika Nayanajith]

Hi Simon,

Yes, you are correct. You require 7.5.x onwards to have wildcard rogue SSID classification. Here is what 7.5.102.0 Release notes says about it.

 "In the earlier releases, you could create rogue policy rules based on SSID, but the SSID had to be an exact match. In this release, you can create rogue policy rules based on wildcard SSID, where the rule is enforced by any SSID that contains the wildcard SSID string. You can configure up to 25 wildcard rule per rogue rule."

HTH

Rasika

**** Pls rate all useful responses ****