Network Management

Reply
Contributor I
Posts: 24
Registered: ‎10-31-2016

Move Suspected Rogue to Rouge AP

Dear allfriends and expert,

 

Im researching WIPS/WIDS features with RFprotect license.

When i plug into an AP ( Aruba) to network and broadcast random SSID.

My controller dectect it AP is Suspected Rouge.

my understand IPS/IDS does not apply for Suspected rouge AP right ?

Thank you so much !

MVP
Posts: 344
Registered: ‎07-26-2011

Re: Move Suspected Rogue to Rouge AP

[ Edited ]

It is dependant on your WIPS rules and what is configured in regards to . If the controller sees evidence of the Suspected Rogue AP on the wired side, it will classify it as Rogue and your containment rules (if any) will be actioned. You can also configure rules to contain suspected rogues based on their calculated confidence level.

 

Protect Suspect Rogue

 

If you need to manually contain an AP, you can do so via Manual Containment under Security -> Contain Manually

 

Take a look at this as it contains some really good information.

 

http://www.arubanetworks.com/assets/tg/TG_WIP.pdf

 

http://www.arubanetworks.com/techdocs/ArubaOS_64x_WebHelp/Content/ArubaFrameStyles/New_WIP/Rogue_AP_Detection.htm

ACMA, ACMP
If my post addresses your query, give kudos:)
Guru Elite
Posts: 20,819
Registered: ‎03-29-2007

Re: Move Suspected Rogue to Rouge AP


Lee Nguyen wrote:

Dear allfriends and expert,

 

Im researching WIPS/WIDS features with RFprotect license.

When i plug into an AP ( Aruba) to network and broadcast random SSID.

My controller dectect it AP is Suspected Rouge.

my understand IPS/IDS does not apply for Suspected rouge AP right ?

Thank you so much !


You can just enable "Suspected Rogue Containment" in the IDS Unauthorized Device Profile:

Screenshot 2017-03-18 at 05.20.29.png



Colin Joseph
Aruba Customer Engineering

Looking for an Answer? Search the Community Knowledge Base Here: Community Knowledge Base

Search Airheads
Showing results for 
Search instead for 
Did you mean: