Cisco CatCenter and WLC 9800 Rogue Auto Containment

[joeharb]

I am working on starting to create some rules for Auto Containment with our CatCenter and WLC.  I created a rule that is based on SSID and I now see that the AP's are classified as the new type.  I set both the new rule and the profile to Auto-Containment Enabled, but it doesn't appear that containment is being started.  I can manually contain within CatCenter but Auto isn't working.  I did notice that the Honeypot rule is part of the new profile and it is not set to enabled for Auto-Containment, does every rule have to be set to this for it to work?

Please advise on how to troubleshoot.

Thanks,

Joe

[Haydn Andrews]

Auto containment needs to be in both the profile and the rule

Word of warning, you want to make 100% sure its a threat, and within your building before containining as there could be legal ramifications of containiment. You also want post containment to send someone out to find the rogue and remove it physically as containment will chew up resources of the AP doing containment, model dependant could also prevent it from servicing clients.

There is also a limit of the number of containments that the WLC can actually support.

Auto-containment is applicable only for High level threat.