Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

AP Containment

Need Clarification

Can the AP containment feature on

CUWN 4.2 be automated to contain rogue APs that are advertising your SSID or is this a manual procedure.

Can the new Cisco mobilty service engine IDS/IPS system do this automatically?

Can Air defense / Air tight / Air Magnet do this?

Mark

1 ACCEPTED SOLUTION

Accepted Solutions
Hall of Fame Super Gold

Re: AP Containment

If this resolves your post, can you tick "resolved"? Thanks.

6 REPLIES
Hall of Fame Super Gold

Re: AP Containment

Containment of Rogue AP can only be done manually. Auto Containment of "Rogue on Wire" and/or "AdHoc Rogue AP", on the other hand, is turned off by default. To enable this feature, go to Security -> Wireless Protection Policies -> Rogue Policies -> General.

Does this help?

New Member

Re: AP Containment

Yes this does help, but I am more concerned with our wireless clients trying to connect to

a rogue AP advertising our SSID, the rogue may or may not be wired in to our LAN. My thoughts are that to rely on manual AP containment is slightly risky as it requires a member of the support staff to look at the WCS logging.

My hopes are that the new Cisco mobility services IDS/IPS offering will automate this.

Thanks for you answers

Mark

Hall of Fame Super Gold

Re: AP Containment

If you are concerned about clients connecting to a Rogue AP with the same SSID (aka "Honeypot"), the WLC/WCS will flag this alarm.

One of the logic why this is not incorporated into the automation is the risk associated that "somebody" in the organization may have innocently setup their very-own AP for company use without telling everyone. There's also a risk of your organization if the WLC/WCS will attack legitimate AP it considers as "Rogue".

True, IPS/IDS will do the trick, but I've been doing this for the past 2 years and I'd rather be the one to throw the switch for the WLC/WCS to contain a possible Rogue AP than let the machine do it for you.

For instance, I saw a a firmware bug where an AP was flagged by the WLC and the WCS as a suspected Honeypot. Upon closer inspection, the so-called Honeypot is an AP register to the same WLC and therefore legitimate.

In my humble opinion ...

New Member

Re: AP Containment

looks like I need to convince the support staff to look at the logs

Hall of Fame Super Gold

Re: AP Containment

If this resolves your post, can you tick "resolved"? Thanks.

Re: AP Containment

here is some further info on rogue containment

http://www.cisco.com/en/US/tech/tk722/tk809/technologies_white_paper09186a0080722d8c.shtml

__________________________________________________________________________________________ "Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin ___________________________________________________________
545
Views
13
Helpful
6
Replies