Rogue AP warning

BlakeRichardson · ‎08-31-2023

HI All

I am getting the below rogue AP alert, the devices are Windows laptops, internet sharing is disabled so it's not that. This alert happens at least once a day and I have run out of ideas to resolve it.

1 rogue AP on the LAN network in the xxxxx organization has been detected.

SSID Rogue because Last seen at # of APs detecting # of APs containing

DIRECT-QHBLAKE-PCLAPTOP-RSBD

Seen on LAN

Thu Aug 31 10:40:44 NZST 2023

3

If you found this post helpful, please give it Kudos. If my answer solves your problem, please click Accept as Solution so others can benefit from it.

aleabrahao · ‎08-31-2023

Someone is probably routing the connection. Not much to do. But you know that a rogue AP is not necessarily malicious, correct?

In this regard, Cisco WLC is more efficient than Maraki.

I am not a Cisco employee. My suggestions are based on documentation of Meraki best practices and day-to-day experience.

Please, if this post was useful, leave your kudos and mark it as solved.

BlakeRichardson · ‎08-31-2023

@alessandrodematos Yes I know that it they are not always malicious. My issue is the false positives and being alerted when someone powers their laptop on. Something must be triggering it.

We only have this issue with a small percentage on Windows laptops, Apple laptops and the majority on Windows laptops are fine.

If you found this post helpful, please give it Kudos. If my answer solves your problem, please click Accept as Solution so others can benefit from it.

ww^ · ‎08-31-2023

https://techcult.com/how-to-disable-wifi-direct-in-windows-10/