Rogue access point

[harpo321]

 Hi,

 we have a deployment with 250 access point and AOS-3.4.4.1 with rogue detection and containment.

We have an air monitor connected to the network in a trunk port to see all vlan´s.

I have some ssids and one of them is a guest network with a PSK . If I connect a wireless router as ap client to this network and redistribute the conection via ethernet port doing nat, the device is not detected as rogue.

It is detected as interfering because there is not a relationship between the wired and wireless mac in the same router.

How can I establish a relationship between both of them?

Thanks

[Plane]

Rogue APs are typically devices that are on your wired network and are rebroadcasting that without any security.  In this case the AP is simply a wireless bridge.  It is no different than a client associating to the AP and gathering data.  In this case how has the ap client gained access to the PSK to join the network?  That would be the real security issue to me.  Someone has broken your security mechanism and gained access to the network.  That ap client could just as easily be a real client that is pulling down data and storing it locally.  That would be a security risk as well.

[harpo321]

Hi,

Really, this is a wireless bridge. The tittle is not correct.

Our institution have many users with guest psk access and the wireless bridge could be installed in any place into the campus.

Is there any procedure to solve this problem? The internal users are dangerous many times.

Thanks

[cjoseph]

I am not sure that we can tell that there is NATTED traffic behind a valid user.  If you are using a PSK to get on your network and someone has the PSK, they are authorized, along with the traffic behind them.  There is no real way to detect that.

Your big issue is that you cannot disable users individually, because you are using a shared PSK.

[harpo321]

Ok, thanks for your answer.

But I thought the "detect wireless bridge" in IDS profile could detect it..