User's Manual

10/10/03 Rogue AP Tagging and Containment
90-100584-004 Airespace Product Guide 61
Rogue AP Tagging and ContainmentRogue AP Tagging and Containment
This built-in detection, tagging, monitoring and containment capability allows system administrators to
take required actions:
• Receive new rogue notifications, eliminating hallway scans.
• Monitor unknown rogues until they are eliminated or acknowledged.
• Determine the closest authorized Airespace Access Points and Third-Party Access Points,
making directed scans faster and more effective.
• Contain rogue APs by sending their clients deauthenticate and disassociate messages from one
to four Airespace APs.
• Tag rogue APs:
- Acknowledge rogue APs when they are outside of the LAN and do not compromise the
LAN or WLAN security.
- Accept rogue APs when they do not compromise the LAN or WLAN security.
- Tag rogue APs as unknown until they are eliminated or acknowledged.
- Tag rogue APs as contained and continue discouraging rogue AP clients from associat-
ing with the rogue AP, by having between one and four Airespace APs transmit deauth-
enticate and disassociate messages to the rogue AP clients. This function can contain
one or more channels on the same rogue AP.
To facilitate automated rogue detection in a crowded RF space, Airespace APs can be configured to
operate in Monitor Mode
, allowing monitoring without creating unnecessary interference.