Wireless Access

Reply
Contributor I

Locating Rouge AP's

I work in a large enviorment with roughly 150 sites (most in the U.S). We have 2 controllers in our data center (3600 & 600) which all of our AP's register to. The corporate office had an auditor come in to evaluate our network security & discovered 11 rogue AP's which are listed in our 6000 controller. I was looking at official Aruba documentation & read that in order for an AP to be classified as a rogue AP that the Aruba AP must scan the wired network looking for mac addresses, routers & gateways. I also read that the rogue AP must be physically connected to the same wired vlan as the Aruba AP. The Aruba document does not mention how an Aruba controller admin can determine which Aruba AP's  were responsible for classifying a rogue AP. If I could find out which Aruba AP in my enviorment made classifications for the rogue AP's in the list, it would help me locate the 11 rogue AP's. Can anyone tell me how to find that out? Or how to find the IP addresses/macs the Aruba AP used to classify a rogue AP? Again I work in an extremely large enviorment and dont have access to most of the switches in our networks. Please help!

Rogue APs on 600.PNG

 

Guru Elite

Re: Locating Rouge AP's

Please read this:  

https://community.arubanetworks.com/aruba/attachments/aruba/ControllerBasedWLANs/47/2/PDFRogueAPGuide.pdf


*Answers and views expressed by me on this forum are my own and not necessarily the position of Aruba Networks or Hewlett Packard Enterprise.*
ArubaOS 8.3 User Guide
InstantOS 8.3 User Guide
Airheads Knowledgebase
Airheads Learning Videos
Contributor I

Re: Locating Rouge AP's

I read the doc but did not see steps on how to enable containment for rogue AP's. I have a 6000 controller running version 6.4.4.16. Is there any extra licensing required or is there a setting that I can enable to ensure the AP's are getting contained? Also I do not have any Air Monitors as far as I know. The only thing I know is my controller model, code version & that none of the rogue AP's are being contained.

 

cont.PNG

Guru Elite

Re: Locating Rouge AP's

Please see the setting here:  http://www.arubanetworks.com/techdocs/ArubaOS_65x_WebHelp/Web_Help_Index.htm#ArubaFrameStyles/New_WIP/Intrusion_Protection.htm#new_wip_1365762209_1025735

 

You do not need a special license for rogue containment.

 

EDIT:  New Link:  http://www.arubanetworks.com/techdocs/ArubaOS_6_5_4_X_Web_Help/Web_Help_Index.htm#ArubaFrameStyles/New_WIP/Intrusion_Protection.htm?Highlight=intrusion protection


*Answers and views expressed by me on this forum are my own and not necessarily the position of Aruba Networks or Hewlett Packard Enterprise.*
ArubaOS 8.3 User Guide
InstantOS 8.3 User Guide
Airheads Knowledgebase
Airheads Learning Videos
Frequent Contributor II

Re: Locating Rouge AP's

Broken link... please put the new one. :)

Guru Elite

Re: Locating Rouge AP's

Search Airheads
cancel
Showing results for 
Search instead for 
Did you mean: