Describes rogue AP scale modes, feature history, advantages and disadvantages of various role-scale modes, configuration procedures, and verification steps to optimize rogue AP management and scaling across different deployment classes.

A rogue AP scale mode is a database management mechanism that

decides if the system adds or discards a newly detected rogue AP when the database reaches its capacity
lets you set quotas or priorities by rogue AP classification to use available space efficiently, and
allows you to customize storage management based on classification needs and resources.

Types of rogue AP scale modes

These modes determine whether the system adds a rogue AP to the database when it reaches maximum scale:

Quota : Quotas apply to each classification as a percentage of the maximum scale. If a classification has a quota of X percent, that portion of the rogue AP database is reserved for the classification. If all memory for that classification is used, the system drops any new rogue APs in that classification.
Priority : Priorities apply to different classifications. If you do not set quotas, the system uses priority mode by default. The system uses these priorities:
- malicious: highest
- custom: high
- unclassified: medium
- friendly: low
The system enforces priorities only when the maximum database scale is reached. If you classify a new rogue AP and the database is full, the system adds it only if there are lower-priority rogue APs that are present. If this happens, the system deletes the newest rogue AP entry of the lowest priority. If there are no lower-priority rogue APs, the system drops the new AP.
Hybrid : Hybrid mode combines quotas and priorities. When space is available, rogue APs of lower priority use any unused quota reserved for higher-priority rogue APs.

Rogue AP scale mode logic after reaching maximum scale

After the rogue AP database reaches maximum scale, the system applies this logic when it classifies a new rogue AP:

If the number of stored rogue APs in the new rogue AP’s class is below its quota, store the new rogue AP and delete the newest rogue AP of the lowest-priority classification that exceeds its quota.
If a lower-priority classification exceeds its quota, the system deletes the newest rogue AP in that classification and stores the new rogue AP.
If neither condition applies, the system drops the new rogue AP.

Note

Configure quotas and priorities carefully to balance security requirements with database limitations.

If you do not configure quotas, the system uses priority mode.

Suppose the database has reached maximum scale and a new rogue AP classified as malicious is detected. If the malicious quota allows storage, the system stores the new rogue AP and removes the newest rogue AP from the lowest-priority classification that exceeds its quota. If no such rogue AP exists, the system drops the new rogue AP.

Feature history for rogue full scale quotas and priorities

This table provides release and related information about the feature explained in this section.

This feature is also available in all the releases subsequent to the one in which they are introduced in, unless noted otherwise.

Table 1. Feature History for Rogue Full Scale Quotas and Priorities
Release	Feature	Feature information
Cisco IOS XE 17.9.1	Rogue full scale quotas and priorities	The rogue full scale quotas and priorities feature helps you to improve the scalability, performance, manageability, and serviceability of rogue Access Points (APs).

Advantages and disadvantages of role-scale modes


Mode	Advantages	Disadvantages
Quota	Simple to use and understand.	Memory is not used efficiently. New rogue APs for a class that is already in its maximum quota are dropped. While the memory reserved for another class that does not have any rogue APs, stays empty. For example, this could lead to dropping malicious rogue APs, while there is still memory available.
Priority	Simple to use and understand. Utilizes the available memory. Stores the important rogue APs.	Some of the lower-priority rogue AP classes might not be represented in the rogue database, if higher-priority rogue APs utilize all the available memory.
Hybrid	Utilizes the available memory, while providing quotas so that all the classes are represented in the database.	Difficult for users to understand the exact behavior.

Configure rogue AP scale (CLI)

Set scale quotas, priorities, and hybrid modes for rogue AP types (malicious, custom, unclassified, friendly) using CLI commands.

Procedure

	1.	Enter global configuration mode. Example: `Device# configure terminal`
	2.	Configure rogue scale quota for malicious, custom, unclassified, and friendly rogue APs. Example: `Device(config)# wireless wps rogue scale quota maliciouspercentage-malicious-rogue-AP custom percentage-custom-rogue-AP unclassified percentage-unclassified-rogue-AP friendly percentage-friendly-rogue-AP` The default value for quota is 0. The sum of all the quotas must be less than or equal to 100 percent. If the sum of all the configured quotas is equal to 0, then priority mode is used. If the sum of all the quotas is not equal to 0, then quota mode is used. If hybrid mode is configured, hybrid mode is used no matter what the quota configuration is. Hybrid mode with all the quotas equal to 0, is identical to the priority mode. Note Hybrid mode is enabled after the maximum scale is reached. All the rogue APs are stored before the maximum scale is reached.
	3.	Configure rogue scale priority for malicious, custom, unclassified, and friendly rogue APs. Example: `Device(config)# wireless wps rogue scale priority malicious highest custom high unclassified medium friendly low` Example: `[no] wireless wps rogue scale priority malicious { high\| highest\| low\| medium } custom{ high \| highest \| low \| medium } unclassified { high \| highest \| low \| medium } friendly { high \| highest \| low \| medium }` The default value for malicious is highest , the default value for custom is high , the default value for unclassified is medium , and the default value for friendly is low .
	4.	Configure rogue scale hybrid mode. Example: `Device(config)# wireless wps rogue scale mode hybrid` Unused quota reserved for higher-priority rogue APs are used by rogue APs of lower priority when space is available.

Rogue AP classification uses configured quotas, priorities, or hybrid mode to efficiently manage detected rogue APs according to defined organizational policies.

Verify rogue scale details

To verify the rogue scale details, run this command:

Device# show wireless wps rogue stats
  Total Post Init/Max            : 0/4000
  Total/Max                      : 0/4200
  Init                           : 0
Classification
  Friendly                       : 0/0/0 (Total/Init/Quota[%])
  Malicious                      : 0/0/0 (Total/Init/Quota[%])
  Custom                         : 0/0/0 (Total/Init/Quota[%])
  Unclassified                   : 0/0/0 (Total/Init/Quota[%])
  Unknown                        : 0/0 (Total/Init)
Configured Quotas by Classification
  Custom         : <% of max scale>
  Friendly       : <% of max scale>
  Malicious      : <% of max scale>
  Unclassified   : <% of max scale>
Configured Priorities by Classification
  Custom          :  2 (High)
  Friendly        :  4 (Low)
  Malicious       :  1 (Highest)
  Unclassified    :  3 (Medium)

Configured Rogue Scale Mode: [Priority|Quota|Hybrid]

To view the rogue ad hoc summary, run this command:

Device# show wireless wps rogue adhoc summary
Detect and report Ad-Hoc Networks : Enabled
Auto-Contain Ad-Hoc Networks      : Disabled
Total Number of Rogue Ad-Hoc      : 0
Friendly Ad-Hoc Rogues            : 0
Malicious Ad-Hoc Rogues           : 0
Custom Ad-Hoc Rogues              : 0
Unclassified Ad-Hoc Rogues        : 0
Unknown Ad-Hoc Rogues             : 0
Client MAC Address   Adhoc BSSID        Classification  State        # APs  Last Heard            
------------------------------------------------------------------------------------------------

Need help?

Open a support case

(Requires a Cisco Service Contract)

The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.

Rogue AP scale modes per class

Types of rogue AP scale modes

Rogue AP scale mode logic after reaching maximum scale

Feature history for rogue full scale quotas and priorities

Advantages and disadvantages of role-scale modes

Configure rogue AP scale (CLI)

Procedure

Example:

Example:

Example:

Example:

Example:

Verify rogue scale details