User guide

2-12

Cisco WLAN Controller Web Interface User Guide

OL-7416-04

Chapter 2 Monitor Menu Bar Selection

Rogue APs

Use MONITOR > Summary > Rogue Summary > Active Rogue APs > Detail or MONITOR >

Wireless > Rogue APs or WIRELESS > Rogue APs to navigate to this page.

This page displays access points in your air space which are not part of your configured network. These

rogue access point radios may be one of the following four types:

• Pending or Alert radio: This type of radio may present a threat to the integrity and security of your

network. It has not been identified as a Known internal radio or as an Acknowledged radio belonging

to another company located near your premises.

• Known radio: This radio has been identified and accepted as being secure. This radio is being used

for accepted company functions, but is not part of the internal network.

• Acknowledged radio: This radio is transmitting from a known source outside of the company

network. This radio may be part of another company’s LAN which is located on another floor or in

close proximity to your network. This radio does not present a security threat to your network.

• Contained radio: Between one and four access points are transmitting de-authorization and

disassociate messages to clients attempting to associate with the rogue access point.

The following information is provided when a rogue access point radio is detected:

This page reports rogue access points until the “Expiration Timeout for Rogue AP Entries” (set on the

Rogue Policy page) expires.

The Edit links in the rogue access point radios table take you to the respective Rogue AP Detail page

when selected.

Table 2-11 Rogue Access Point Radios

Parameter Description

MAC Address Media Access Control address of the rogue access point.

SSID Service Set Identifier being broadcast by the rogue access point radio.

# Detecting Radios Number of Cisco radios detecting the rogue access point radio.

Number of Clients Number of clients currently associated with the rogue access point.

Status Automatic and configurable state of this radio relative to the network or

controller. The status of rogue access point radios appear as one of the

following:

• Pending - OS identification is still underway.

• Alert - first scanned by the controller, and maintained in this state until

the user changes the state.

• Known - known internal access point being used for accepted company

functions, but it is not part of the internal network.

• Acknowledge - this radio is transmiting from an external source outside

of the company network.

• Contained - between one and four access points are transmitting

deauthorization and disassociate messages to clients attempting to

associate with this rogue access point.