Rogue WLAN Detection on Wired LAN

[fdharmawan]

Hi Guys,

So I am currently in the start of access point migration from Cisco to Meraki. My current deployment is:
5520 WLC running on 8.10.162.0
3802 as client serving APs
2802 as WIPS APs with MSE

Let's say the SSID that being broadcasted on my environment is XYZ123. If I remember it correctly, either the WIPS or the WLC can somehow detect if a rogue AP if broadcasting the same SSID as the legitimate one, XYZ123, then perform something to prevent this. Am I remember this correctly? The only documentation online from Cisco that I can find is this (section Rogue Detector AP).

Since my pilot phase, at some point, will use the same SSID and authentication method as the production one, I am kind of worried that the pilot phase will be disrupted by or maybe disrupt the existing production. Has anyone have this kind of experience before? Thank you.

[marce1000]

            >....Since my pilot phase, at some point, will use the same SSID
  - Is there a real need to use the same SSID on a pilot phase , if it 'comes from Meraki' , I think that could be
    troublesome indeed.
                    If the pilot phase can use another SSID ; it will be better for testing.

 M.

[fdharmawan]

At the first place, we will create a dummy SSID. The first pilot will be on IT room, and the second pilot will be on the whole floor before deploying it to other floors. My concern is when the 2nd pilot phase. From wireless perspective, I'm less concerned, since the floor itself is not next to each other with other floors, there are some gaps, but the LAN segment is the same. So I wonder whether it will affect the production.

[marce1000]

  - How will the clients to be able to distinguish between the pilot SSID and the wireless production environment  
    when it its the same ? So , in general : use another one    like 'pilottest' and switch over when everything is ready
    for production and when you can abandon the old setup (at the same time)

 M.

[fdharmawan]

Well, for the first phase of the pilot, we will use the different name. But for the second phase, we will use the same SSID name as our purpose is that it will be seamless for the users. But this second phase pilot is kind of separated from the others physically, but logically, in VLAN, they are the same.

I am not concerned about the interference or the availability of 2 same SSID names in the air, but rather what it's like in the switch. Shall I be worried about that?

[marce1000]

 - I don't think you should be worried about the switch , but follow up on it's logs (and or configure a syslog server for it) , when the
   intended project is started , 

 M.

[fdharmawan]

Okay, thank you Marce. Since we have WIPS, hopefully it doesn't start to disrupt the existing. Because as far as I understand from the document, it only creates an alert for the rogue WLAN.

I have syslog server setup in place, we use Splunk. So I will start to monitor the alerts and create a Splunk alert if I find any.

The pilot might start to start next week.

[Rich R]

The feature you are referring to is called containment.

Containment should always be used with extreme caution and could be illegal if used without strict controls.  So you should make sure that neither the old network nor the new Meraki network have containment enabled otherwise they could try to contain each other.
https://www.cisco.com/c/en/us/support/docs/wireless/4400-series-wireless-lan-controllers/112045-handling-rogue-cuwn-00.html#toc-hId-715491869
https://documentation.meraki.com/MR/Monitoring_and_Reporting/Air_Marshal