Isolating Rogue Aps; Using The Rogue Ap Isolation Feature - HP Aruba JL253A Management And Configuration Manual

Isolating Rogue APs

One of the important features to turn on in a mobile-first deployment is the ability of the switches to detect and
quarantine rogue access points. Administrators would like to prevent unauthorized access to their networks and a
rogue AP can open up the network to unwanted users and traffic.
The Rogue AP Isolation feature detects and blocks any unauthorized APs in the network. You can either log or
block the rogue device. If the action requested is to log the rogue device, the MAC address of the rogue device is
logged in the system logs (RMON). If the action is to block the rogue device, the traffic to and from the MAC
address of the rogue device is blocked. The MAC is also logged in the system log.
When an Aruba AP detects a rogue AP on the network, it sends out the MAC address of the AP as well as the
MAC of the clients connected to the AP to the switch using the ArubaOS-Switch proprietary LLDP TLV protocol.
The switch then adds a rule in its hardware table to block all the traffic originating from the rogue AP's MAC
address.
The rogue-ap-isolation command configures the rogue AP isolation for the switch and gives the option to
enable or disable the rogue AP isolation feature. The rogue-ap-isolation action command gives you the
ability to block the traffic to or from the rogue device or log the MAC of the rogue device. When the action is set to
block, the rogue MAC is logged as well. By default, the action is set to block.
The rogue-ap-isolation whitelist command lets you add devices detected as possible rogue APs to the
whitelist. A maximum of 128 MAC addresses are supported for the whitelist.
The clear rogue-aps command clears the detected rogue AP device MAC address.

Using the Rogue AP Isolation feature

Procedure
1. Check the feature state:
switch# show rogue-ap-isolation
Rogue AP Isolation
Rogue AP Status : Disabled
Rogue AP Action : Block
Rogue MAC Address Neighbour MAC Address
----------------- ---------------------
2. Enable the feature:
switch# rogue-ap-isolation enable
switch# show rogue-ap-isolation
Rogue AP Isolation
Rogue AP Status : Enabled
Rogue AP Action : Block
Rogue MAC Address Neighbour MAC Address
----------------- ---------------------
3. Change the action type from block to log:
switch# rogue-ap-isolation action log
switch# show rogue-ap-isolation
724 Aruba 2930F / 2930M Management and Configuration Guide
for ArubaOS-Switch 16.08