Soft Rogue Access Point

[hassam991]

Hi,

I have run into a problem where I need some expert advice from people who have actually faced this issue. Many of you wireless guys might be knowing about recent emergence of "Soft Rogue Access Point" and how it can cause a nuisance to an IT administrator. As a matter of fact the windows 7 virtual AP feature can easily allow any employee to enable this feature on their laptops, so traditional security mechanism won't seem to be applicable.
I was thinking of ISE device profiling for this purpose but I am not sure if it can do any good. The only option the seems to be implementing a wIPS solution, but I wan to know if any body have actually used Cisco's or any other wIPS for this purpose and how well it works?
Regards,

Hassam

[Saravanan Lakshmanan · Accepted solution]

soft APs are harder to detect than rogue access points because the soft AP can appear as an authorized station to all wired-side network scans.

Cisco wips:-

http://www.cisco.com/en/US/docs/wireless/mse/3350/5.2/wIPS/configuration/guide/msecg_appA_wIPS.html#wp1166170

Regarding Windows soft ap I believe that your best option is to disable this via group policy and only allow clients to connect to infrastructure access point again via group policy.

Also, On all corp laptops, if possible deny permission to enable this feature

[hassam991]

Thanks for the link. I guess throwing in a full blown MSE infrastructure seems to be the only option then with Cisco. Meanwhile tighter compliance standards, for now as you mentioned would do some good.