Specifications

Intrusion Detection Configuration 307
Chapter 15
Rogue AP
Rogue APs represent perhaps the largest threat to enterprise network security
because they bypass all other security provisions and open a network up to
the outside world. Rogue APs are normally placed by employees who do not
understand the risks their actions represent.
A rogue AP is defined as one that is a) unauthorized, and b) plugged into the
wired side of the network. Any other AP seen in the RF environment that is
not part of the valid enterprise network is considered “interfering” – it has the
potential to cause RF interference, but is not connected to the enterprise
wired network and thus does not represent a direct threat. Alcatel is unique in
providing the classification function to ensure that valid, interfering, and rogue
APs are accurately and automatically classified.
To configure rogue AP detection and protection capabilities, navigate to
Configuration > Wireless LAN Intrusion Detection > Rogue AP as shown in the
figure below.
FIGURE 15-1 Rogue AP Configuration
Rogue AP detection and classification is enabled by default. To view AP
classification reports, navigate to
Reports > AP Reports as described in
“Monitoring the Wireless Environment”.
Available configuration parameters are:
Disable Users from Connecting to Rogue APs – By default, rogue APs are
only detected, but are not automatically disabled. Enable this option to
automatically shut down rogue APs. When this option is enabled, clients
attempting to associate to a rogue AP will be disconnected from the rogue AP
through a denial of service attack.