Hi Paddy,
First of all be cautious with containment, doing it wrong might have legal consequences.
With containment the client will receive a deauth message from an access-point which spoofs the MAC address of the access-point on which the client was connected. By default this message cannot be verified by the client and the client will act on it. However, since 2009 there is a protocol called 802.11w (PMF) that allows the access-point and client to agree on a certain hash while performing the 4 way handshake. This hash is being used to sign and validate the management messages, so with help of this hash the client can validate the incoming deauth message and ignore it when needed :-)
Back in 2005 Cisco developed MFP (Management Frame Protection) to battle this same problem. Cisco's implementation contains of two parts: infrastructure and client MFP. The client MFP part is somewhat the same as 802.11w but requires the client to be CCXv5 compatible. However, the infrastructure side is not covered in 802.11w. With infrastructure MFP access-points add a MIC to their management frames, based on this your own access-points can report about received spoofed management frames as well. This does not stop it from happening or your clients to ignore it from trusting, but will generate a message on the WLC which you can use for further investigation.
It is possible to active Cisco MFP and 802.11w PMF at the same time, I do not recommend to configure it to be "required" due to the lack of support on clients (unless you really know that your clients support it). The 802.11w PMF configuration can be found under the layer 2 security tab of the SSID. MFP configuration can be done under security -> wireless protection policy -> AP authentication & MFP.
Please rate useful posts... :-)
