User's Manual

3/11/05 Rogue Access Points
OL-7426-02
About Rogue Access PointsRogue Access Points
Because they are inexpensive and readily available, employees are plugging unauthorized rogue access
points (Rogue APs) into existing LANs and building ad hoc wireless networks without IT department
knowledge or consent.
These Rogue APs can be a serious breach of network security, because they can be plugged into a
network port behind the corporate firewall. Because employees generally do not enable any security
settings on the Rogue APs, it is easy for unauthorized users to use the access point to intercept network
traffic and hijack client sessions. Even more alarming, wireless users and war chalkers frequently
publish unsecure access point locations, increasing the odds of having the enterprise security breached.
Rather than using a person with a scanner to manually detect Rogue APs, the Cisco SWAN automati-
cally collects information on Rogue APs detected by its managed Cisco 1000 Series IEEE 802.11a/b/g
Lightweight Access Points, by MAC and IP Address, and allows the Network operator to locate, tag and
monitor them as described in the Detecting and Locating Rogue Access Points section. The Operating
System can also be used to discourage Rogue AP clients by sending them deauthenticate and disasso-
ciate messages from one to four Cisco 1000 Series lightweight access points. Finally, the Operating
System can be used to automatically discourage all clients attempting to authenticate with all
Rogue APs on the enterprise subnet. Because this real-time detection is automated, it saves labor costs
used for detecting and monitoring Rogue APs while vastly improving LAN security.
Note that the peer-to-peer, or ad-hoc, clients can also be considered Rogue APs.
See also Rogue AP Location, Tagging and Containment
.
Rogue AP Location, Tagging and ContainmentRogue AP Location, Tagging and Containment
This built-in detection, tagging, monitoring and containment capability allows system administrators to
take required actions:
• Locate Rogue APs as described in Detecting and Locating Rogue Access Points.
• Receive new Rogue AP notifications, eliminating hallway scans.
• Monitor unknown Rogue APs until they are eliminated or acknowledged.
• Determine the closest authorized Cisco 1000 Series IEEE 802.11a/b/g Lightweight Access
Points, making directed scans faster and more effective.
• Contain Rogue APs by sending their clients deauthenticate and disassociate messages from one
to four Cisco 1000 Series lightweight access points. This containment can be done for individual
Rogue APs by MAC address, or can be mandated for all Rogue APs connected to the enterprise
subnet.
• Tag Rogue APs:
- Acknowledge Rogue APs when they are outside of the LAN and do not compromise the
LAN or WLAN security.
- Accept Rogue APs when they do not compromise the LAN or WLAN security.
- Tag Rogue APs as unknown until they are eliminated or acknowledged.
- Tag Rogue APs as contained and discourage clients from associating with the Rogue AP
by having between one and four Cisco 1000 Series lightweight access points transmit
deauthenticate and disassociate messages to all Rogue AP clients. This function
contains all active channels on the same Rogue AP.
Rogue Detector mode detects whether or not a rogue is on a trusted network. It does not provide RF
service of any kind, but rather receives periodic rogue reports from the switch, and sniffs all ARP
packets. If it finds a match between an ARP request and a MAC address it receives from the switch, it
generates a rogue alert to the switch.