Rogue Scan - Avaya AP-7 User Manual

Performing Advanced Configuration

Rogue Scan

The Rogue Scan feature provides an additional security level for wireless LAN deployments.
Rogue Scan uses the selected wireless interface(s) for scanning its coverage area for Access
Points and clients.
A centralized Network Manager receives MAC address information from the AP on all wireless
clients detected by the AP. The Network Manager then queries all wired switches to find out the
inbound switch/port of these wireless clients. If the switch/port does not have a valid Access
Point connected to it as per a pre-configured database, the Network Manager proceeds to block
that switch/port and prevent the Rogue AP from connecting to the wired network.
Figure 40 shows Client 1 connected to a Trusted AP and Client 2 connected to a Rogue AP.
The Trusted AP scans the networks, detects Client 2, and notifies the Network Manager. The
Network Manager uses SNMP/CLI to query the wired switch to find the inbound switch port of
Client 2's packets. The Network Manager verifies that this switch/router and port does not have
a valid Access Point as per the administrator's database. Thus it labels Client 2's AP as a
Rogue AP and proceeds to prevent the Rogue AP attack by blocking this switch's port.
Figure 40: Preventing Rogue AP Attacks
112 Avaya Wireless AP-7 User Guide