How to Classify AdHoc Rogues?

[jnlawrence76]

I have been able to manually classify the Unclassified APs that I find, however I have not been able to find out a way to manually classify Adhoc Rogues.  Can anyone point me in the right direction?  Do I have to creat a rule in order to classify Adhoc Rogues?

Thanks in Advance

WLC - 7.0.98.0

WCS - 6.0.170.0

[Leo Laohoo]

On the WLC:

Rogues > Adhoc Rogues > MAC Address > Contain

[jnlawrence76]

If I set them to "Contain" will this cause a problem for the AdHoc devices?

[Leo Laohoo]

Nuts.

You can aside from "Contain", you can choose some more options:   Contain, Alert, Internal, External

When you contain, you are literally sending successive de-authenticate packet to the client.  This is similar to doing a DDoS.

[jnlawrence76]

What about setting a rule to set adhocs to "External"?  I have about 500 showing up right now and manually changing each one would take some time.  I only seem to see the ability to create rules for Rogue APs

[Leo Laohoo · Accepted solution]

Go to WCS Home > Security Tab > Total Active Adhoc Rogues > under Adhoc Rogue Alarms put a "tick" on the Adhoc Rogues of your choice > on the upper left-hand corner there's a drop-down box > choose "External".

Hope this helps.  Please don't forget to rate our useful posts.  Thanks.