Configuring Rogue AP Detection (requires Level 10 permission)

To configure rogue AP detection:

1. Click Configuration  > Wireless IDS/IPS  > Rogue APs.
   The Global Settings page appears.
2. In the Detection list, select one of the following:
   • On: Enables scanning for rogue APs.
   • Off: Disables rogue detection.
3. In the Mitigation list, select one of the following:
   • No mitigation: No rogue AP mitigation is performed.
   • Block all BSSIDs that are not in the ACL: Enables rogue AP mitigation of all detected  BSSIDs that are not specified as authorized in the Allowed APs list.
   • Block only BSSIDs in blocked list: Enables rogue AP mitigation only for the BSSIDs that are listed in the Blocked APs list.
   • Block Clients seen on the wire: Enables rogue mitigation for any rogue station detected on the wired side of the AP (the corporate network, in many cases).
4. For Rogue AP Aging, type the amount of time that passes before the rogue AP alarm is cleared if the controller no longer detects the rogue. The value can be from 60 through 86,400 seconds.
5. For the Number of Mitigating APs, enter the number of APs (from 1 to 20) that will perform scanning and mitigation of rogue APs.
6. For Scanning time in ms, enter the amount of time that mitigating APs will scan the scanning channels for rogue APs. This can be from 100 to 500 milliseconds.
7. For Operational time in ms, enter the amount of time Mitigating APs will spend in operational mode on the home channel. This can be from 100 to 5000 milliseconds.
8. For Max mitigation frames sent per channel, enter the maximum number of mitigation frames that will be sent to the detected rogue AP. This can be from 1 to 50 deauth frames.
9. For Scanning Channels, enter the list of channels that will be scanned for rogue APs. Use a comma separated list from 0 to 256 characters. The complete set of default channels are 1,2,3,4,5,6,7,8,9,10,11,36,40,44,48,52,56,60,64,149,153,157,161,165.
10. For RSSI Threshold for Mitigation, enter the minimum threshold level over which stations are mitigated. The range of valid values is from to -100 to 0.  
11. Click OK
12. To allow an AP, click the tab Allowed APs, then add the BSSID of the access point to the list and click OK.
13. To block an AP, click the tab Blocked APs, then add the BSSID of the access point to the list and click OK.