Is there any methods in cisco switches (without using extra devices or softwares)to detect and prevent the unauthorised access points connected? I found a method using wireless lan controller (WLC). But some one said that there is another method using commands to block the unauthorised access points. Is there any such methods?
2 Answers
Try with Port Security
Port security allows you to specify a maximum number of MAC addresses per interface and a security policy if the maximum number of addresses is reached. Since an AP is a L2 device your switch will learn multiple MAC addresses from a single ethernet interface (as if it was a switch).
-
-
802.1x authentication; but it is more complex to configure since you have to re-configure the whole network. Oct 2, 2013 at 7:00
Not really sure if this counts as a "method" but as pointed out, AP's are L2, so looking at the CAM table "show mac-address table" for interfaces with multiple macs is usually a giveaway that either an AP, soho-switch/hub etc. is connected to that port.
You can also set up dedicated AP's for RLDP. WCS also has a 'switch-port tracer' for Rogues (not sure if this was ported to Cisco Prime Infrastructure); but both the latter methods require a lightweight infrastructure (ie WLC's).
Note that even if you "contain" rogues with deauth frames, or simply 'shut' the port they are connected to, this does not address possibly the biggest issue (other than 'security') of rogue AP's...the RF. Policy, the staff to 'locate' them and the 'tools' is really the best method. The best tool I've found for 'locating' them, once on-site is Fluke AirCheck w/ directional antenna.
sample RF policy: https://www.cisco.com/en/US/prod/collateral/wireless/ps9391/ps9393/prod_white_paper0900aecd8073bef9.pdf
You're probably already aware of this RLDP info: http://www.cisco.com/en/US/tech/tk722/tk809/technologies_white_paper09186a0080722d8c.shtml
radicetrentasei
, it is always a good practice to shutdown unused ports on your switch and enabling them should be part of a defined process for adding devices to your network.