What is the behavior of the user who connects to SSID honeypot after installing the auto-containment wips feature

[riski.safaat]

I am currently testing the use of the auto containment feature to detect honeypot threats. The feature is already running well, the alarm can also detect if there is a malicious threat but I am still confused about how user behavior connects to honeypot? is it still able to connect to the SSID Honeypot but is interrupted by an access point associated with WLC or should the user not be able to connect at all?

Because at this time I test user can still connect to honeypot but only intermittently.
If anyone understands this case, please help.

[patoberli]

See the answer here: https://community.cisco.com/t5/wireless-security-and-network/wlc-quot-rogue-containment-quot-what-does-it-actually-do/td-p/1012588
It looks like the APs near it will start to send de-authentication packets.