Wireless Access

Hi everyone :)

I discovered that there is a rogue AP plugged into the Cisco switch, but I can't tell which switch port the rogue AP is plugged into. Clients successfully entered the fake SSID to the internet.

Please explain to me why clients can access the internet and how to prevent APs on the device system.

I can go to the site to detect the signal through the analyzer software, but I live quite far away and there are many sites.

 I really want advice, thank you very much.

Depending on the Cisco Switch Type (supported Device or not) you can put it as monitored Device into AirWave. Than you will get the Switch Port Information in the Rogue dashboard / Report.

Hi everyone :)

I discovered that there is a rogue AP plugged into the Cisco switch, but I can't tell which switch port the rogue AP is plugged into. Clients successfully entered the fake SSID to the internet.

Please explain to me why clients can access the internet and how to prevent APs on the device system.

I can go to the site to detect the signal through the analyzer software, but I live quite far away and there are many sites.

 I really want advice, thank you very much.

Thank you,

The wan port of the Wifi Router (AP Rogue) has been cloned to the MAC, so how can you detect the AP Rogue?

Depending on the Cisco Switch Type (supported Device or not) you can put it as monitored Device into AirWave. Than you will get the Switch Port Information in the Rogue dashboard / Report.

Hi everyone :)

I discovered that there is a rogue AP plugged into the Cisco switch, but I can't tell which switch port the rogue AP is plugged into. Clients successfully entered the fake SSID to the internet.

Please explain to me why clients can access the internet and how to prevent APs on the device system.

I can go to the site to detect the signal through the analyzer software, but I live quite far away and there are many sites.

 I really want advice, thank you very much.

Hi

If you list all the client MAC addresses on the switch, can you eliminate all legit MAC addresses and find the MAC address of the Rouge AP?

Do you have any form of authentication on the switch ports?

Thank you,

The wan port of the Wifi Router (AP Rogue) has been cloned to the MAC, so how can you detect the AP Rogue?

Depending on the Cisco Switch Type (supported Device or not) you can put it as monitored Device into AirWave. Than you will get the Switch Port Information in the Rogue dashboard / Report.

Hi everyone :)

I discovered that there is a rogue AP plugged into the Cisco switch, but I can't tell which switch port the rogue AP is plugged into. Clients successfully entered the fake SSID to the internet.

Please explain to me why clients can access the internet and how to prevent APs on the device system.

I can go to the site to detect the signal through the analyzer software, but I live quite far away and there are many sites.

 I really want advice, thank you very much.

Thank you,

I manage quite a few branches and it is very difficult to control MAC Clients. The Rogue AP was cloned to the same MAC as the internal computer's MAC and was in wifi Router mode (NAT mode) so I couldn't actually find it on the system.

Hi

If you list all the client MAC addresses on the switch, can you eliminate all legit MAC addresses and find the MAC address of the Rouge AP?

Do you have any form of authentication on the switch ports?

Thank you,

The wan port of the Wifi Router (AP Rogue) has been cloned to the MAC, so how can you detect the AP Rogue?

Depending on the Cisco Switch Type (supported Device or not) you can put it as monitored Device into AirWave. Than you will get the Switch Port Information in the Rogue dashboard / Report.

Hi everyone :)

I discovered that there is a rogue AP plugged into the Cisco switch, but I can't tell which switch port the rogue AP is plugged into. Clients successfully entered the fake SSID to the internet.

Please explain to me why clients can access the internet and how to prevent APs on the device system.

I can go to the site to detect the signal through the analyzer software, but I live quite far away and there are many sites.

 I really want advice, thank you very much.

As Jonas stated, a future proof solution would be implementing 802.1X on ETH Ports. With ClearPass you can use factory default Certificates of that AP. 

Or you use Username Password with EAP-PEAP. with any Radius Server.

No one onsite who can have a look for that device?

Thank you,

I manage quite a few branches and it is very difficult to control MAC Clients. The Rogue AP was cloned to the same MAC as the internal computer's MAC and was in wifi Router mode (NAT mode) so I couldn't actually find it on the system.

Hi

If you list all the client MAC addresses on the switch, can you eliminate all legit MAC addresses and find the MAC address of the Rouge AP?

Do you have any form of authentication on the switch ports?

Thank you,

The wan port of the Wifi Router (AP Rogue) has been cloned to the MAC, so how can you detect the AP Rogue?

Depending on the Cisco Switch Type (supported Device or not) you can put it as monitored Device into AirWave. Than you will get the Switch Port Information in the Rogue dashboard / Report.

Hi everyone :)

I discovered that there is a rogue AP plugged into the Cisco switch, but I can't tell which switch port the rogue AP is plugged into. Clients successfully entered the fake SSID to the internet.

Please explain to me why clients can access the internet and how to prevent APs on the device system.

I can go to the site to detect the signal through the analyzer software, but I live quite far away and there are many sites.

 I really want advice, thank you very much.