Rogue AP Contain on SSID questions

[Seyidoff]

Security>Wireless Protection Policies>Rogue Polices>General>Auto Contain> Check box = Using our SSID = enabled.

it doesn't work

can anyone help me?

[Haydn Andrews]

Firstly be courious with auto containment as there are legal ramifications of using it.

The auto containment will use your APs to send de-auth to the clients joining that AP, if they are using WPA3 or Management Frame protection it wont work. 

An over the air capture will show if its actually happening as well

[Seyidoff]

How can I prevent it if a hacker shares from my ssid and users connect to it?

[Rich R]

You can't.  You can detect it and take action yourself manually if they do.

But if your SSID is properly secured using the features Haydn mentioned above then it will be extremely difficult (if not impossible) for anybody to replicate your SSID unless they already know your WPA3 PSK.  What security are you using on the SSID?

[JPavonM]

The use of countermeasures for Rogue APs not connected to your network is illegal in most of the countries, even if they are publishing your SSID.

The only problem that I see from SSID impersonation is if the rogue AP publish your SSID with Open access, as that's the only way that your users can connect to it and putting them under risk.

If your concern is about users complaining about connectivity issues becuase both SSIDs use encryption, so all devices have problems when connecting, and the SSID is not malicious, is to find the offender and remove the AP, or tell the neighbour company to change the SSID. That happened to me few months ago.

[jwikiera]

Ensure that "Auto Containment only for Monitor Mode APs" is not checked (unless there are APs in monitor mode).
"show wireless wps rogue ap detail" contains the containment level or why it failed.

Rogue BSSID : ...
Last heard Rogue SSID : ...
802.11w PMF required : No
Is Rogue an impersonator : No
...Classification : Malicious
Manually Contained : No
State : Contained
Containment Level : 1
Number of Containing APs : 1
...
Last containment result : Success
Containment
Containment slot ID : 0
Containment Mode : DEAUTH_BCAST
Containment Channels : 6

If  802.11w (Protected Management Frames) is required, then containment is not started unless rogue containment pmf-denial is enabled and rogue AP is on AP's client serving channel (see link beneath, text config only, 'rogue detection containment pmf-denial' in 'ap profile'). Also, if a rogue AP is detected on a radar DFS channel, then no containment is done.

https://www.cisco.com/c/en/us/td/docs/wireless/controller/ewc/17-12/config-guide/ewc_cg_17_12/radio_resource_management.pdf