Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.1.x

PDF

Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.1.x

Rogue PMF containment

Updated: April 10, 2026

Want to summarize with AI?

Log in

Provides an overview of rogue Protected Management Frame (PMF) concepts, configuration tasks, and verification references for wireless security management.

Rogue PMF containment is a wireless security feature that

  • uses 802.11w Protected Management Frames (PMF) to contain rogue APs and clients

  • operates on centrally switched WLANs when the radio channel of the detecting AP matches the rogue AP's channel, and

  • activates only when certain mode and channel conditions are met to secure the network against unauthorized devices.

Feature history

Table 1. Feature history table for rogue PMF containment

Feature name

Release information

Feature description

Rogue PMF containment

Cisco IOS XE 17.12.1

Starting with Cisco IOS XE Dublin 17.12.1, the controller contains a rogue AP with 802.11w Protected Management Frame (PMF) on centrally switched wireless LANs. Containment occurs if the client-serving radio channel of a rogue-detecting AP matches the channel of the corresponding rogue AP.

Operational scenarios

PMF containment occurs in these scenarios:

  • You can use PMF containment only in the local mode.

  • You can perform PMF containment only for rogue clients that have not joined a rogue AP.

  • You can use PMF containment only if a rogue-detecting AP shares the same primary channel with a rogue client.

  • You cannot use PMF containment on DFS channels, even if a DFS channel serves as the client-serving channel.

  • PMF containment works only if at least one WLAN operates on the serving radio.

For information about APs that support the Rogue PMF Containment feature, see Cisco AP Feature Matrix.

Enable rogue PMF containment

Enable PMF containment to protect your wireless network from rogue APs.

Procedure

1.

Enter global configuration mode.

Example:

Device# configure terminal
2.

Configure an AP profile and enter AP profile configuration mode.

Example:

Device(config)# ap profile ap-profile
3.

Enable PMF-denial rogue AP containment.

Example:

Device(config-ap-profile)# rogue detection containment pmf-denial
4.

Enable PMF-denial type deauthentication rogue AP containment.

Example:

Device(config-pmf-denial)# pmf-deauth
5.

Return to privileged EXEC mode.

Example:

Device(config-ap-profile)# end

Rogue AP PMF containment is enabled for the specified AP profile. 

Device# configure terminal
Device(config)# ap profile pmf-ap-profile
Device(config-ap-profile)# rogue detection containment pmf-denial
Device(config-pmf-denial)# pmf-deauth
Device(config-ap-profile)# end

Verify PMF containment

To verify PMF containment and the relevant statistics, use these commands.

To view the summary of containment details for all AP radios, use this command

Device# show wireless wps rogue containment summary 

Rogue Containment activities for each managed AP
 
AP: 687d.b45f.2ae0  Slot: 1
  Active Containments   : 3
   Containment Mode     : DEAUTH_PMF
   Rogue AP MAC         : 687d.b45f.2a2d
   Containment Channels : 40

To verify the rogue statistics, use this command:

Device# show wireless wps rogue stats 
.
.
.
 States
  Alert                          : 256
  Internal                       : 0
  External                       : 0
  Contained                      : 1
  Containment-pending            : 0
  Threat                         : 0
  Pending                        : 0
Rogue Clients
  Total/Max Scale                : 20/16000
  Contained                      : 0
  Containment-pending            : 0
.
.
.