Campus lan and Wireless lan solution Design Guide

Rogue device detection 
An organization can regard any device unmanaged by the organization that shares the organization’s RF 
spectrum as a rogue device. A rogue device becomes dangerous in the following scenarios: 
● 
Rogue AP with the same SSID as your network (often called a 
honeypot
) 
● 
Rogue AP device also on the wired network
● 
Ad-hoc rogue devices 
● 
Rogue devices set up for malicious intent by someone outside the organization 
There are three main phases of rogue device management in the Cisco Catalyst wireless solution: 
● 
Detection
—Managed using RRM scanning in order to detect the presence of rogue devices. 

---

© 2020 Cisco and/or its affiliates. All rights reserved. 
Page 58 of 76
● 
Classification
—Managed using rogue location discovery protocol (RLDP) and switch port tracing in order 
to identify whether the rogue device is connected to the wired network. Rogue device classification rules 
also assist in filtering rogue devices into specific categories based on the characteristics of a device. 
● 
Mitigation
—Managed using switch port tracing and disablement, rogue device location, and rogue device 
containment in order to track down physical location and nullify the threat of rogue devices. 
Cisco DNA Center release 1.3.1.3 and higher supports the Rogue Management application within Cisco DNA 
Assurance. The Rogue Management application allows you visualize rogue APs as well as their potential threat 
level (informational, potential, or high) from within Cisco DNA Center.
For additional information about a range WLAN controller versions, visit cisco.com and 
search for "Wireless 
Rogue Management
." 
Radio Resource Management (RRM) 
To optimize efficiency, RRM software embedded in the Cisco Wireless LAN Controller acts as a manager to 
constantly monitor over-the-air metrics and control the RF transmitted. It measures: 
●