WLC - 'Active Rogue Clients' and 'Adhoc Rogues'

david.kelsen · ‎04-20-2009

Under the 'Rogue Summary' on our WLCs we sometimes see some 'Active Rogue Clients' and 'Adhoc Rogues'.

I'm just wondering if this is 'FYI Only', or am I meant to do something with this information?

I've tried MAC Filtering and/or adding the offending MAC address to the 'Disabled Clients' list, but it doesn't seem to reduce/stop these 'Active Rogue Clients' or 'Adhoc Rogues'.

Any help/suggestions/clarifications welcome...

Leo Laohoo · ‎04-20-2009

Now this is a thorny issue.

AdHoc Rogues are hosts (like laptops, PDA's, printers) with their wireless turned on and attempting to connect to each other (without the use of an AP).

This is a thorny issue because it's hard to regulate users using a "free" spectrum.

In my network, I'd "contain" Rogues when I have verified that they are found WITHIN our building or premises. This is also the main reason why I'd recommend to disable auto-containment of Rogues (default) as you can detect Rogues from your WLC's even if the users are found OUTSIDE your building/premises.

If you plan to contain Rogues, make sure you have an approved written policy regarding the Rogues otherwise you might get yourself into trouble.

Hope this helps.