Technical data

Chapter 11

Rogue AP Detection and Mitigation

Rogue APs are unauthorized wireless access points. These rogues can be physically

connected to the wired network or they can be outside the building in a neighbor's

network or they can be in a hacker’s parked car. Valid network users should not be

allowed to connect to the rogue APs because rogues pose a security risk to the corpo-

rate network. Rogue APs can appear in an enterprise network for reasons as innocent

as users experimenting with WLAN technology, or reasons as dangerous as a malicious

attack against an otherwise secure network. Physical security of the building, which

is sufficient for wired networks with the correct application of VPN and firewall tech-

nologies, is not enough to secure the WLAN. RF propagation inherent in WLANs

enables unauthorized users in near proximity of the targeted WLAN (for example, in

a parking lot) to gain network access as if they were inside the building.

Rogue detection and mitigation are currently supported on Meru access points as

shown in the table below.

Table 11: Meru Support of Rogue Detection and Mitigation

Regardless of why a rogue AP exists on a WLAN, it is not subject to the security poli-

cies of the rest of the WLAN and is the weak link in an overall security architecture.

Even if the person who introduced the rogue AP had no malicious intent, malicious

activity can eventually occur. Such malicious activity includes posing as an autho-

rized access point to collect security information that can be used to further exploit

the network. Network security mechanisms typically protect the network from unau-

thorized users but provide no means for users to validate the authenticity of the

network itself. A security breach of this type can lead to the collection of personal

information, protected file access, attacks to degrade network performance, and

attacks to the management of the network.

Rogue Detection Rogue Mitigation

AP300 3.4.2 and later 3.7 and later

AP1000 4.1 and later 4.1 and later

AP400 4.2 and later 4.2 and later

AP150 3.6.1 and later 3.6.1 and later

OAP180 3.6.1 and later 3.6.1 and later

RS4000 3.6.1 3.6.1