Rogue AP

[hs08]

In the WLC we can contain the Rouge AP, but how we can make sure our AP is not contained by neighbor WLC if the my AP located not to far with neighbor AP?

[Haydn Andrews · Accepted solution]

To start off containment is technically illegal in most countries, unless the rogue is connected to your network or broadcasting your SSID to be malicious.

You would see aWIPS events of Deauthentication Flood, but you need Catalyst Center for aWIPS. That being said you would see clients being dropped from your network as containment will send clients connecting to it deauthentication frames.

Easiest way to protect is to run MFP as mandatory

https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-5/config-guide/b_wl_17_5_cg/m_awips.html 

[Rich R]

> how we can make sure our AP is not contained by neighbor WLC
You cannot control how the other WLC is configured, but if they break the law (illegal containment) you can report them to the regulator for regulatory enforcement (but a friendly chat with your neighbours might be the better option).  But like @Haydn Andrews says using MFP ensures that spoof de-auth frames (which is how containment is done) cannot be used.
https://en.wikipedia.org/wiki/IEEE_802.11w-2009
https://techsearch.watchguard.com/KB?type=Article&SFDCID=kA10H000000bqRZSAY&lang=en_US