Cisco Meraki Air Marshal Questions

[scross1]

Hi,

I was hoping some people in the community could help me understand better the function of the Air Marshal features in Meraki. From what I can tell from my testing with it, it can only block internal rogue SSIDs, but is there any thing we can do about external threats? From what I can tell the only thing to do would be walk around and find the external threat and neutralize it that way.

Another issue I'm having is that it will only alert once when it sees a rogue SSID or spoof. I get an email at the start and then it wont email me again even if it goes offline and then comes back online. I assume it remembers that spoof and then wont notify again based on that, but is there anyway around this? Say if we think we get rid of it but then it comes up again 2 days later we will have no way of knowing unless we are checking every day.

Thanks for any help!

[JPavonM]

From my past experience playing around with Meraki APs, and from a more recent experience defending my Cisco WLAN Infrastructure, enabling AirMarshall to prevent rogue devices is a very intensive admin task. I mention this because if you do not take care of the feature, and rely on the easyness of "Meraki's magic" (but also all "Enterprise" platforms that are out there with such label), APs could be creating a DDoS over any neighbour WLAN.

Let me further explain myself. A couple of years ago I noticed that some devices connected to an office with Cisco APs were being deauthenticated. After some packet captures I realized that there was a deauth attack in progress, and my APs were receiving deauth packets for all connected clients. Further investigation on the MAC OUIs in the vicinity lead me to think there were some Meraki APs that maybe had the AirMashall feature enabled with anti-rogue measures enabled.

At the end my suspicious was right and we found a neighbour company where the admins enabled that feature thinking it was magic as Meraki sell, but not taking care about the alerts and the logs, nor reviewing the AirMarshall dashboard. After explaining them the episode and the technology they turned it off and all problems dissapeared.

My recommendation, take special care about WIPS features, specially in easy-to-manage solutions such as in Meraki, as you could be maybe impacting neighbours, and you could be fined becuase of this.

HTH
-Jesus
*** Please rate helpful responses ***

[Rich R]

We had a very similar experience at a customer site (a major hotel). One of their neighbours enabled Air Marshall (without understanding what they were doing) and 'contained' our customer's Cisco WiFi network.

After we identified the cause and had a friendly chat with the neighbour to explain what they were doing they turned it off.

Note that in most countries jamming somebody else's radio network is ILLEGAL except in very specific circumstances where you may be required to protect your own network.  Indiscriminate use of containment can land you in trouble.

Just because you see a 'rogue' does not make it a threat.

Unless someone is intentionally trying to impersonate your SSID or attack your clients they are not a threat - they're just another WiFi network/user.