Rogue detection - rogue channel width

Enter the global configuration mode.

Device# configure terminal

Create or enable a rule.

Device(config)# wireless wps rogue rule rule-name priority priority

Configure channel width and band for rogue detection.

Device(config-rule)# condition chan-width {160MHz | 20MHz | 40MHz | 80MHz} band {24ghz | 5ghz | 6ghz}

Use Step 4, 5, 6, or 7.

(Optional) Classify devices matching this rule as friendly.

Device(config-rule)# classify friendly state {alert | external | internal}

(Optional) Classify devices matching this rule as malicious.

Device(config-rule)# classify malicious state {alert | contained}

(Optional) Classify devices matching this rule as custom.

Device(config-rule)# classify custom severity-score severity-score [name name] state {alert | contained}

Ignore the devices matching this rule.

Device(config-rule)# classify delete

Return to privileged EXEC mode.

Device(config-rule)# end

Choose Configuration > Security > Wireless Protection Policies > Rogue AP Rules to open the Rogue Rules window.

Create a new rule with these steps:

1. Click Add.

2. In the Add Rogue AP Rule window, enter a name for the new rule, in the Rule Name field. Ensure that the name does not contain any spaces.

3. From the Rule Type drop-down list, choose one of these options to classify rogue APs matching this rule:

   • Friendly

   • Malicious

   • Unclassified

   • Custom

4. From the State drop-down list, configure the state of the rogue AP. This is the state when the rule matches the conditions for the rogue APs.

   • Alert: A trap is generated when an ad hoc rogue is detected.

   • Internal: A foreign ad hoc rogue is trusted.

   • External: The presence of an ad hoc rogue is acknowledged.

   • Contain: The ad hoc rogue is contained.

   • Delete: The ad hoc rogue is removed.

   Note

   The State field is not displayed if you select Unclassified as the Rule Type.

5. If you chose the Rule Type as Custom, enter the Severity Score and the Custom Name.

6. Click Apply to Device to add this rule to the list of existing rules, or click Cancel to discard this new rule.

(Optional) Edit a rule using these steps:

1. Click the name of the rule that you want to edit.

2. In the Edit Rogue AP Rule page that is displayed, from the Type drop-down list, choose one of these options to classify rogue APs matching this rule:

   • Friendly

   • Malicious

   • Custom

3. Configure the notification from the Notify drop-down list to All, Global, Local, or None after the rule is matched.

4. Configure the state of the rogue AP from the State drop-down list after the rule is matched.

5. From the Match Operation field, choose one of these options:

   • Match All: The detected rogue AP must meet all of the conditions specified by the rule for the rule to be matched and the rogue AP to adopt the classification type of the rule.

   • Match Any: The detected rogue AP must meet any of the conditions specified by the rule for the rule to be matched and the rogue AP to adopt the classification type of the rule. This is the default value.

6. To enable this rule, check the Enable Rule check box. The default is unchecked.

7. If you chose the Rule Type as Custom, enter the Severity Score and the Classification Name.

8. From the Add Condition drop-down list, choose one or more of the conditions that the rogue AP must meet:

   • None: No condition is set for rogue AP detection.

   • client-count: Condition requires that a minimum number of clients be associated to the rogue AP. For example, if the number of clients associated to the rogue AP is greater than or equal to the configured value, then the AP can be classified as malicious. If you choose this option, enter the minimum number of clients to be associated with the rogue AP in the Minimum Number of Rogue Clients field. The valid range is 1 to 10 (inclusive), and the default value is 0.

   • duration: Condition requires that the rogue AP be detected for a minimum period of time. If you choose this option, enter a value for the minimum detection period in the Time Duration field. The valid range is 0 to 86400 seconds (inclusive), and the default value is 0 seconds.

   • encryption: Condition requires that the advertised WLAN have specified encryption. Requires that the rogue AP’s advertised WLAN does not have encryption enabled. If a rogue AP has encryption disabled, it is likely that more clients will try to associate with it. No further configuration is required for this option.

   • infrastructure: Condition requires that the rogue AP’s SSID (the SSID configured for the WLAN) be known to the controller. Select the Manage SSID check box to enable this configuration.

   • rssi: Condition requires that the rogue AP have a minimum received signal strength indication (RSSI) value. For example, if the rogue AP has an RSSI that is greater than the configured value, then the AP could be classified as malicious. If you choose this option, enter the minimum RSSI value in the Maximum RSSI field. The valid range is 0 to –128 dBm (inclusive).

   • channel-width: Condition requires that the rogue AP use the specified radio spectrum channel width for the specified radio band, as defined. The valid channel widths are 20, 40, 80, and 160MHz.

     • For APs to be classified as Malicious, Custom or Delete, it must match the value (equal or more) set in the Minimum Channel Width drop-down list.

     • For APs to be classified as Friendly, it must match the value (equal or less) set using an option from the Maximum Channel Width drop-down list.

   • ssid: Condition requires that the rogue AP have a specific user-configured SSID. If you choose this option, enter the SSID in the User Configured SSID text field, and click + to add the SSID.

   • substring-ssid: Condition requires that the rogue AP have a substring of the specific user-configured SSID. The controller searches the substring in the same occurrence pattern and returns a match if the substring is found in the SSID string.

Click Apply to Device to save the configuration.

Click OK.