Authenticating APs and WLCs

Question

I am currently learning about WLCs and Lightweight APs.

My book mentions that every AP and WLC must authenticate each other with digital certificates, and that a X.509 certificate is preinstalled in each device when it is purchased.

How does this prevent someone from connecting a rogue AP to the network? What if their device is preinstalled with a digital certificate too?

Answer 1

How does this prevent someone from connecting a rogue AP to the network?

It doesn't. but consider what has to happen:

1. The AP needs to get an address on the subnet it's connected to.
2. The AP needs to know the address of the controller. This can be learned via the DHCP lease, if configured.
3. The controller needs to accept the AP join request.

All these things may indeed happen, and the "rogue" AP joins the WLC. But now the AP is under the control of the WLC, so it only does what the WLC tells it to. In that sense, it's no longer a "rogue."

Practically speaking, an unknown AP would be placed in a "default group" that doesn't have any WLANs associated with it, so it wouldn't provide any wireless access.