testing rouge detection 802.11N is under the radar of the wireless network

michael.lussier · ‎02-20-2009

I was testing rouge detection and port location. My rouge is a new 802.11N Linksys home AP. The AP is up on the network and I have a laptop connected and using the AP.

The lwap AP's within the vacinity have yet to see it and identify the device. The APs on the lwap side are 1252's and they are all fully functional. 4.2.176.0 is the code that is in place right now. Our scheduled upgrade to 5.2 is weeks away.

WCS has yet to report this rouge on the network nor the fact that it is also on the wired network as well. Has anyone else seen this ? This is a big concern from two fronts. State office locations using these devices and the fact that they can't be identified.

Johannes Luther · ‎02-20-2009

I have a few questions regarding your case:

- Do you broadcast the SSID on your rogue AP?

- Do you use WEP/WPA/WPA2 on your rogue AP, or is it an open network?

michael.lussier · ‎02-20-2009

YEs I did turn on Broadcast and the rouge was running a WPA2-PSK network

Johannes Luther · ‎02-20-2009

The rogue discovery protocol works like that (I guess):

The AP, that detects the rogue AP, associates with the rogue - obtains an IP via DHCP and pings the management IP of the WLC. If the WLC responds, the rogue is in the wired network.

I doubt it'll work, if the rogue AP has encryption/authentication in place.

George Stefanick · ‎02-21-2009

I gather you cant even see the rogue to test if it is on your wire.

Here is a link that may help you. I would also recommend putting the AP in rogue dect mode for giggles...

http://www.cisco.com/en/US/tech/tk722/tk809/technologies_white_paper09186a0080722d8c.shtml')">http://www.cisco.com/en/US/tech/tk722/tk809/technologies_white_paper09186a0080722d8c.shtml

"Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin
___________________________________________________________

Leo Laohoo · ‎03-04-2009

Go to Security -> Wireless Protection Policy -> Rogue Policies and verify your settings.

You can also go to Rogue Rules and add specific details.