AP Aironet 1830/ME rogue access point detection

[pdenableetoavit19698]

Hi there,

Trying to have a better understanding of the "rogue access point detection" functionality.

How it works and what it does ? Is it mainly showing nearby AP that are conflicting on channels etc with your own, or actual AP trying to login/join the network etc?

Thank you for help!

[Scott Fella]

It is just showing you what ap's it can hear and providing you that list.  It is passive so it doesn't do anything else.

[Rich R]

https://www.cisco.com/c/en/us/td/docs/wireless/access_point/mob_exp/86/best_practices/b_ME_Best_Practices_Guide_86/security.html#security-rogue-policies

[JPavonM]

The "problem" is that Cisco wrongly uses 'rogue AP' to identify all access points in the vicinity, and then categorize them as 'Malicious' if they are into the wired network, or 'Unclassified' for external ones.

Then there is a 'Honeypot' which is an unmanaged access point that is using the same SSID than ours (infrastructure SSID). This honeypot could be external, or connected to our wired network, so in this case it would act as Rogue AP and Honeypot at the same time.

However, the 'rogue AP' definition states that this is an unmanaged access point connected to the same wired network that our managed access point is connected to.

Other vendors use this definition and don't alert about OBSS networks like Cisco do in both AireOS and C9800 WLCs, reducing the list of possible threats to the minimum ones that pose a real threat.

At the same time other vendors uses only one signature (Rogue AP or Honeypot) to categorize a threat so in the case of an AP connected to our network and broadcasting our SSID, it would be very difficult to know that this is a real threat to the network at first sight.