Is there any methods in cisco switches (without using extra devices or softwares)to detect and prevent the unauthorised access points connected? I found a method using wireless lan controller (WLC). But some one said that there is another method using commands to block the unauthorised access points. Is there any such methods?

  • I don't quite understand the question. Your question asks about methods "in Cisco switches", but then you mentioned using finding a way in the WLC and you want another method "using commands". Where exactly do you want to block APs? Why isn't blocking them on the WLC sufficient? Also see this question about blocking rogue APs. Sep 27 '13 at 6:57
  • Apart from using port security as mentioned by radicetrentasei, it is always a good practice to shutdown unused ports on your switch and enabling them should be part of a defined process for adding devices to your network.
    – AdnanG
    Sep 27 '13 at 12:49
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer.
    – Ron Maupin
    Jan 5 '21 at 17:28

Try with Port Security

Port security allows you to specify a maximum number of MAC addresses per interface and a security policy if the maximum number of addresses is reached. Since an AP is a L2 device your switch will learn multiple MAC addresses from a single ethernet interface (as if it was a switch).

  • is there any method other than port security
    – sunnychen
    Oct 1 '13 at 15:31
  • 802.1x authentication; but it is more complex to configure since you have to re-configure the whole network. Oct 2 '13 at 7:00

Not really sure if this counts as a "method" but as pointed out, AP's are L2, so looking at the CAM table "show mac-address table" for interfaces with multiple macs is usually a giveaway that either an AP, soho-switch/hub etc. is connected to that port.

You can also set up dedicated AP's for RLDP. WCS also has a 'switch-port tracer' for Rogues (not sure if this was ported to Cisco Prime Infrastructure); but both the latter methods require a lightweight infrastructure (ie WLC's).

Note that even if you "contain" rogues with deauth frames, or simply 'shut' the port they are connected to, this does not address possibly the biggest issue (other than 'security') of rogue AP's...the RF. Policy, the staff to 'locate' them and the 'tools' is really the best method. The best tool I've found for 'locating' them, once on-site is Fluke AirCheck w/ directional antenna.

sample RF policy: https://www.cisco.com/en/US/prod/collateral/wireless/ps9391/ps9393/prod_white_paper0900aecd8073bef9.pdf

You're probably already aware of this RLDP info: http://www.cisco.com/en/US/tech/tk722/tk809/technologies_white_paper09186a0080722d8c.shtml

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.