Network Management

Dear allfriends and expert,

Im researching WIPS/WIDS features with RFprotect license.

When i plug into an AP ( Aruba) to network and broadcast random SSID.

My controller dectect it AP is Suspected Rouge.

my understand IPS/IDS does not apply for Suspected rouge AP right ?

Thank you so much !

It is dependant on your WIPS rules and what is configured in regards to . If the controller sees evidence of the Suspected Rogue AP on the wired side, it will classify it as Rogue and your containment rules (if any) will be actioned. You can also configure rules to contain suspected rogues based on their calculated confidence level.

If you need to manually contain an AP, you can do so via Manual Containment under Security -> Contain Manually

Take a look at this as it contains some really good information.

http://www.arubanetworks.com/assets/tg/TG_WIP.pdf

http://www.arubanetworks.com/techdocs/ArubaOS_64x_WebHelp/Content/ArubaFrameStyles/New_WIP/Rogue_AP_Detection.htm

---

@Lee Nguyen wrote:

Dear allfriends and expert,

 

Im researching WIPS/WIDS features with RFprotect license.

When i plug into an AP ( Aruba) to network and broadcast random SSID.

My controller dectect it AP is Suspected Rouge.

my understand IPS/IDS does not apply for Suspected rouge AP right ?

Thank you so much !

---

You can just enable "Suspected Rogue Containment" in the IDS Unauthorized Device Profile: