Cisco Catalyst Center Rogue Management and aWIPS Application Quick Start Guide, Release 3.1.x

PDF

Wired rogue AP containment

Updated: December 15, 2025

Want to summarize with AI?

Log in

Overview

Banner with a blue check mark indicates that the Wireless Rogue AP Containment request is in progress.

The Wired Rogue AP Containment feature allows Catalyst Center to shut down the ACCESS mode interface on the switch to which a rogue AP is physically attached. Catalyst Center performs wired rogue AP containment only on ACCESS mode interfaces, because shutting down any other mode might bring the network down.

If the rogue AP is attached to non-ACCESS mode interfaces, the network admin must contain the interface either manually or through a CLI command.

This procedure describes how to perform wired rogue AP containment on an ACCESS mode interface classified as Rogue on Wire in Catalyst Center.

Before you begin

Download and install the rogue and aWIPS application package. For more information, see Download and Install the Rogue Management and aWIPS application package.

Ensure that you have write permission from the provision API, scheduler API, and rogue side to perform this procedure.

Procedure

1.

From the main menu, choose Assurance > Rogue and aWIPS > Threats.
2.

Click the rogue AP MAC address is classified as Rogue on Wire in the Threat MAC address column.

The Threat 360 window appears.
3.

From the Action drop-down list, select Shutdown Switchport.

A warning dialog box displays the list of ACCESS mode interfaces to be shut down on the corresponding device, and Configuration Preview information.

Note

The Shutdown Switchport option appears in the Action drop-down list only when the rogue AP MAC address is marked as Rogue on Wire. For more information, see the Cisco Rogue AP Containment Actions Compatibility Matrix.

The Shutdown Switchport action is irreversible. You must manually bring the switchport back up.
4.

In the Configuration Preview tab, review the configurations and click Yes.

Note

The Configuration Preview tab appears only when Configuration Preview is enabled. For information on how to enable this preview, see the "Enable Visibility and Control of Configurations" topic in the Cisco Catalyst Center Administrator Guide.

5.

The Threat 360 window displays the wired rogue AP containment status:

  • A banner with a blue check mark indicates that the wired rogue AP containment request is in progress.

  • A banner with a green check mark indicates that the wired rogue AP containment is initiated successfully on the corresponding interface.

  • A banner with a red check mark indicates that the wired rogue AP containment request failed.

Note

  • After containment is initiated, it takes some time for the interface state to be updated from Rogue on Wire to another threat classification type.

  • The Rogue on Wire classification type changes to another classification type upon the arrival of the next wireless rogue message for the same rogue AP.

If a rogue AP MAC address is classified as Rogue on Wire, but no ACCESS mode interfaces are up to initiate the containment, Catalyst Center disables the Shutdown Switchport option in the Action drop-down list.

Note

You cannot initiate Wireless Rogue AP Containment unless the rogue AP to which it corresponds to is as long as in the Rogue on Wire classification type. For more information, see Wireless Rogue AP Containment.