Any rules that have already been created are listed in priority order. The name, type, and status of each rule is provided.

1. Click Add Rule. An Add Rule section appears at the top of the page.
2. In the Rule Name text box, enter a name for the new rule. Ensure that the name does not contain any spaces.
3. From the Rule Type drop-down list, choose from the following options to classify rogue access points matching this rule as friendly or malicious:

   • Friendly

   • Malicious

   • Custom

4. Configure the notification when the rule is matched from the Notify drop-down list to All, Global, Local, or None.

   Note

   Rogue Rule Notification options All, Global, Local, and None can control only the following rogue traps mentioned: Rogue AP Detected (Rogue AP: XX:XX:XX:XX:XX:XX detected on Base Radio MAC: XX:XX:XX:XX:XX:XX Interface no: 0(1) Channel: 6 RSSI: 45 SNR: 10 Classification: unclassified, State: alert, RuleClassified : unclassified, Severity Score: 100, RuleName: rule1, Classified AP MAC: XX:XX:XX:XX:XX:XX, Classified RSSI: 45) Rogue Adhoc Detected (Adhoc Rogue : XX:XX:XX:XX:XX:XX detected on Base Radio MAC : XX:XX:XX:XX:XX:XX Interface no: 0(1) on Channel 6 with RSSI: 45 and SNR: 10 Classification: unclassified, State: alert, RuleClassified: unclassified, Severity Score: 100, RuleName: rule1,Classified APMAC: XX:XX:XX:XX:XX:XX, Classified RSSI: 45) Rogue AP contained (Rogue AP: Rogue with MAC Address: XX:XX:XX:XX:XX:XX has been contained due to rule with containment Level : 1) Rogue AP clear contained (Rogue AP: Rogue with MAC Address: XX:XX:XX:XX:XX:XX is no longer contained due to rule

5. Configure the state of the rogue AP when the rule is matched from the State drop-down list.
6. If you choose the Rule Type as Custom, enter the Severity Score and the Classification Name.
7. Click Add to add this rule to the list of existing rules, or click Cancel to discard this new rule.

1. Click the name of the rule that you want to edit. The Rogue Rule > Edit page appears.

2. From the Type drop-down list, choose from the following options to classify rogue access points matching this rule:

   • Friendly

   • Malicious

   • Custom

3. Configure the notification when the rule is matched from the Notify drop-down list to All, Global, Local, or None.
4. Configure the state of the rogue AP when the rule is matched from the State drop-down list.
5. From the Match Operation text box, choose one of the following:

   Match All—If this rule is enabled, a detected rogue access point must meet all of the conditions specified by the rule in order for the rule to be matched and the rogue to adopt the classification type of the rule.

   Match Any—If this rule is enabled, a detected rogue access point must meet any of the conditions specified by the rule in order for the rule to be matched and the rogue to adopt the classification type of the rule. This is the default value.

6. To enable this rule, select the Enable Rule check box. The default value is unselected.
7. If you choose the Rule Type as Custom, enter the Severity Score and the Classification Name.
8. From the Add Condition drop-down list, choose one or more of the following conditions that the rogue access point must meet and click Add Condition.
   • SSID—Requires that the rogue access point have a specific user-configured SSID. If you choose this option, enter the SSID in the User Configured SSID text box, and click Add SSID.

     Note	To delete an SSID, highlight the SSID and click Remove.

   • RSSI—Requires that the rogue access point have a minimum received signal strength indication (RSSI) value. For example, if the rogue access point has an RSSI that is greater than the configured value, then the access point could be classified as malicious. If you choose this option, enter the minimum RSSI value in the Minimum RSSI text box. The valid range is –95 to –50 dBm (inclusive), and the default value is 0 dBm.

   • Duration—Requires that the rogue access point be detected for a minimum period of time. If you choose this option, enter a value for the minimum detection period in the Time Duration text box. The valid range is 0 to 3600 seconds (inclusive), and the default value is 0 seconds.

   • Client Count—Requires that a minimum number of clients be associated to the rogue access point. For example, if the number of clients associated to the rogue access point is greater than or equal to the configured value, then the access point could be classified as malicious. If you choose this option, enter the minimum number of clients to be associated to the rogue access point in the Minimum Number of Rogue Clients text box. The valid range is 1 to 10 (inclusive), and the default value is 0.

   • No Encryption—Requires that the rogue access point’s advertised WLAN does not have encryption enabled. If a rogue access point has encryption disabled, it is likely that more clients will try to associate to it. No further configuration is required for this option.

     Note	Cisco Prime Infrastructure refers to this option as “Open Authentication.”

   • Managed SSID—Requires that the rogue access point’s managed SSID (the SSID configured for the WLAN) be known to the controller. No further configuration is required for this option.

     Note

     The SSID and Managed SSID conditions cannot be used with the Match All operation because these two SSID lists are mutually exclusive. If you define a rule with Match All and have these two conditions configured, the rogue access points are never classified as friendly or malicious because one of the conditions can never be met. You can add up to six conditions per rule. When you add a condition, it appears under the Conditions section.

     Note	To delete a condition from this rule, hover your cursor over the blue drop-down arrow for that condition and click Remove.

   • SSID Wildcard—Requires that the rogue access point have a substring of the specific user-configured SSID. The controller searches the substring in the same occurrence pattern and returns a match if the substring is found in the whole string of an SSID.

9. Click Apply.

1. Click Back to return to the Rogue Rules page.

2. Click Change Priority to access the Rogue Rules > Priority page.

   The rogue rules are listed in priority order in the Change Rules Priority text box.

3. Highlight the rule for which you want to change the priority, and click Up to raise its priority in the list or Down to lower its priority in the list.

4. Continue to move the rules up or down until the rules are in the desired order.

5. Click Apply.

• Choose Security > Wireless Protection Policies > Rogue Policies > Friendly Rogue to open the Friendly Rogue > Create page.
• In the MAC Address text box, enter the MAC address of the friendly rogue access point.
• Click Apply.
• Click Save Configuration. This access point is added to the controller’s list of friendly access points and should now appear on the Friendly Rogue APs page.

• Friendly APs

• Malicious APs

• Unclassified APs

• Custom APs

The respective rogue APs pages provide the following information: the MAC address and SSID of the rogue access point, channel number, the number of radios that detected the rogue access point, the number of clients connected to the rogue access point, and the current status of the rogue access point.

This page provides the following information: the MAC address of the rogue device, the type of rogue device (such as an access point), whether the rogue device is on the wired network, the dates and times when the rogue device was first and last reported, and the current status of the device.

The Class Type text box shows the current classification for this rogue access point:

• Friendly—An unknown access point that matches the user-defined friendly rules or an existing known and acknowledged rogue access point. Friendly access points cannot be contained.

• Malicious—An unknown access point that matches the user-defined malicious rules or is moved manually by the user from the Friendly or Unclassified classification type.

  Note

  Once an access point is classified as Malicious, you cannot apply rules to it in the future, and it cannot be moved to another classification type. If you want to move a malicious access point to the Unclassified classification type, you must delete the access point and allow the controller to reclassify it.

• Unclassified—An unknown access point that does not match the user-defined friendly or malicious rules. An unclassified access point can be contained. It can also be moved to the Friendly or Malicious classification type automatically in accordance with user-defined rules or manually by the user.

• Custom—A user-defined classification type that is tied to rogue rules. It is not possible to manually classify a rogue as Custom. Custom class change can occur only using rogue rules.

• Internal—The controller trusts this rogue access point. This option is available if the Class Type is set to Friendly.

• External—The controller acknowledges the presence of this rogue access point. This option is available if the Class Type is set to Friendly.

• Contain—The controller contains the offending device so that its signals no longer interfere with authorized clients. This option is available if the Class Type is set to Malicious or Unclassified.

• Alert—The controller forwards an immediate alert to the system administrator for further action. This option is available if the Class Type is set to Malicious or Unclassified.

The bottom of the page provides information on both the access points that detected this rogue access point and any clients that are associated to it. To see more details for any of the clients, click Edit to open the Rogue Client Detail page.

• Contain—The controller contains the offending device so that its signals no longer interfere with authorized clients.

• Alert—The controller forwards an immediate alert to the system administrator for further action.

The bottom of the page provides information on the access points that detected this rogue client.

This page shows the following information: the MAC address, BSSID, and SSID of the ad-hoc rogue, the number of radios that detected the ad-hoc rogue, and the current status of the ad-hoc rogue.

This page provides the following information: the MAC address and BSSID of the ad-hoc rogue, the dates and times when the rogue was first and last reported, and the current status of the rogue.

• Contain—The controller contains the offending device so that its signals no longer interfere with authorized clients.

• Alert—The controller forwards an immediate alert to the system administrator for further action.

• Internal—The controller trusts this rogue access point.

• External—The controller acknowledges the presence of this rogue access point.

• 1—Specifies targeted rogue access point is contained by one access point. This is the lowest containment level.

• 2—Specifies targeted rogue access point is contained by two access points.

• 3—Specifies targeted rogue access point is contained by three access points.

• 4—Specifies targeted rogue access point is contained by four access points. This is the highest containment level.

This page shows the MAC addresses of any access points that are configured to be ignored. The rogue-ignore list contains a list of any autonomous access points that have been manually added to Cisco Prime Infrastructure maps by the users. The controller regards these autonomous access points as rogues even though the Prime Infrastructure is managing them. The rogue-ignore list allows the controller to ignore these access points. The list is updated as follows:

• When the controller receives a rogue report, it checks to see if the unknown access point is in the rogue-ignore access point list.

• If the unknown access point is in the rogue-ignore list, the controller ignores this access point and continues to process other rogue access points.

• If the unknown access point is not in the rogue-ignore list, the controller sends a trap to the Prime Infrastructure. If the Prime Infrastructure finds this access point in its autonomous access point list, the Prime Infrastructure sends a command to the controller to add this access point to the rogue-ignore list. This access point is then ignored in future rogue reports.

• If a user removes an autonomous access point from the Prime Infrastructure, the Prime Infrastructure sends a command to the controller to remove this access point from the rogue-ignore list.

config rogue rule add ap priority priority classify {friendly | malicious} rule-name

If you later want to change the priority of this rule and shift others in the list accordingly, enter the config rogue rule priority priority rule-name command.

If you later want to change the classification of this rule, enter the config rogue rule classify {friendly | malicious} rule-name command.

If you ever want to delete all of the rogue classification rules or a specific rule, enter the {config rogue rule delete {all | rule-name} command.

• Configure a rule for friendly rogues by entering this command:

  config rogue rule add ap priority priority classify friendly notify {all | global | local | none} state {alert | internal | external | delete} rule-name

• Configure a rule for malicious rogues by entering this command:

  config rogue rule add ap priority priority classify malicious notify {all | global | local | none} state {alert | contain} rule-name

• Configure a rule for custom rogues by entering this command:

  config rogue rule add ap priority priority classify custom severity-score classification-name notify {all | global | local | none} state {alert | contain} rule-name

If you later want to change the priority of this rule and shift others in the list accordingly, enter the config rogue rule priority priority rule-name command.

If you later want to change the classification of this rule, enter the config rogue rule classify {friendly | malicious | custom severity-score classification-name} rule-name command.

If you ever want to delete all of the rogue classification rules or a specific rule, enter the {config rogue rule delete {all | rule-name} command.

config rogue rule state {alert | contain | internal | external} rule-name

config rogue rule notify {all | global | local | none} rule-name

config rogue rule disable {all | rule_name}

config rogue rule condition ap set condition_type condition_value rule_name

The following condition types are available:

• ssid—Requires that the rogue access point have a specific SSID. You should add SSIDs that are not managed by the controller. If you choose this option, enter the SSID for the condition_value parameter. The SSID is added to the user-configured SSID list.

  Note	If you ever want to delete all of the SSIDs or a specific SSID from the user-configured SSID list, enter the config rogue rule condition ap delete ssid {all | ssid} rule_name command.

  Note	The sub-string should be specified in full or part of SSID (without any asterisks). This sub-string is matched in the same sequence to its occurrence in the rogue AP SSID. Once the condition is met, the rogue AP is classified (depending on OR or AND match condition).

• rssi—Requires that the rogue access point have a minimum RSSI value. For example, if the rogue access point has an RSSI that is greater than the configured value, then the access point could be classified as malicious. If you choose this option, enter the minimum RSSI value for the condition_value parameter.

  In Release 8.0 and later releases, for friendly rogue rules, you are required to set a maximum RSSI value. The RSSI value of the rogue AP must be less than the RSSI value set, for the rogue AP to be classified as a friendly rogue. For malicious and custom rogue rules, there is no change in functionality.

  For example, for a friendly rogue rule, the RSSI value is set at –80 dBm. All the rogue APs that are detected and have RSSI value that is less than –80 dBm are classified as friendly rogues. For malicious and custom rogue rules, the RSSI value is set at –80 dBm. All the rogue APs that are detected and have RSSI value that is more than –80 dBm are classified as malicious or custom rogue APs.

• duration—Requires that the rogue access point be detected for a minimum period of time. If you choose this option, enter a value for the minimum detection period for the condition_value parameter. The valid range is 0 to 3600 seconds (inclusive), and the default value is 0 seconds.

• client-count—Requires that a minimum number of clients be associated to the rogue access point. For example, if the number of clients associated to the rogue access point is greater than or equal to the configured value, then the access point could be classified as malicious. If you choose this option, enter the minimum number of clients to be associated to the rogue access point for the condition_value parameter. The valid range is 1 to 10 (inclusive), and the default value is 0.

• managed-ssid—Requires that the rogue access point’s SSID be known to the controller. A condition_value parameter is not required for this option.

  Note	You can add up to six conditions per rule. If you ever want to delete all of the conditions or a specific condition from a rule, enter the config rogue rule condition ap delete all condition_type condition_value rule_name command.

• wildcard-ssid—Requires that the rogue access point have a wildcard of the specific user-configured SSID. The controller searches the wildcard in the same occurrence pattern and returns a match if the substring is found in the whole string of an SSID.

config rogue rule match {all | any} rule_name

config rogue ap friendly {add | delete} ap_mac_address

save config

show rogue rule detailed rule_name