CISCO-LWAPP-ROGUE-MIB

This MIB is intended to be implemented on all those
devices operating as Central Controllers, that
terminate the Light Weight Access Point Protocol
tunnel from Cisco Light-weight LWAPP Access Points.
        
This MIB provides information about the Rogue APs
and Clients that are detected by the controller.
        
The relationship between CC and the LWAPP APs
can be depicted as follows:
        
      +......+     +......+     +......+
      +      +     +      +     +      +
      +  CC  +     +  CC  +     +  CC  +
      +      +     +      +     +      +
      +......+     +......+     +......+
        ..            .             .
        ..            .             .
       .  .            .             .
      .    .            .             .
     .      .            .             .
    .        .            .             .
+......+ +......+     +......+      +......+
+      + +      +     +      +      +      +
+  AP  + +  AP  +     +  AP  +      +  AP  +
+      + +      +     +      +      +      +
+......+ +......+     +......+      +......+
           .              .             .
         .  .              .             .
        .    .              .             .
       .      .              .             .
      .        .              .             .
   +......+ +......+     +......+      +......+
   +      + +      +     +      +      +      +
   +  MN  + +  MN  +     +  MN  +      +  MN  +
   +      + +      +     +      +      +      +
   +......+ +......+     +......+      +......+
        
        
The LWAPP tunnel exists between the controller and
the APs.  The MNs communicate with the APs through
the protocol defined by the 802.11 standard.
        
LWAPP APs, upon bootup, discover and join one of the
controllers and the controller pushes the configuration,
that includes the WLAN parameters, to the LWAPP APs.
The APs then encapsulate all the 802.11 frames from
wireless clients inside LWAPP frames and forward
the LWAPP frames to the controller.
        
                   GLOSSARY
        
Access Point ( AP )
        
An entity that contains an 802.11 medium access
control ( MAC ) and physical layer ( PHY ) interface
and provides access to the distribution services via
the wireless medium for associated clients.  
        
LWAPP APs encapsulate all the 802.11 frames in
LWAPP frames and sends them to the controller to which
it is logically connected.
        
Light Weight Access Point Protocol ( LWAPP )
        
This is a generic protocol that defines the 
communication between the Access Points and the
Central Controller. 
        
Mobile Node ( MN )
        
A roaming 802.11 wireless device in a wireless
network associated with an access point. Mobile Node 
and client are used interchangeably. 
        
Rogue
        
Any 802.11 device which is not part of the RF network 
is a Rogue device.
        
Ad-hoc Network 
        
A set of mobile devices within direct communication 
range establishing a network among themselves for 
transmitting data, without the use of a Access point 
is called a ad-hoc network. 
        
Rogue Ad-hoc Client
        
Any 802.11 client which is part of that ad-hoc network, 
but not in the trusted list.
        
Service Set Identifier ( SSID )
        
SSID is a unique identifier that APs and clients
use to identify with each other.  SSID is a simple
means of access control and is not for security.
The SSID can be any alphanumeric entry up to 32
characters.
        
RSSI
        
Received Signal Strength Indication (RSSI), the IEEE 802.11
standard defines a mechanism by which RF energy is to be
measured by the circuitry on a wireless NIC. Its value is
measured in dBm and ranges from -128 to 0.
        
Rogue Location Detection Protocol (RLDP)
        
RLDP is a protocol to detect and automatically 
contain rogue devices. When the controller discovers 
a rogue access point, it uses the Rogue Location 
Discovery Protocol (RLDP) to determine if the 
rogue is attached to your network.
RLDP can be enabled/disabled per controller level.
        
LRAD (LWAPP RADIO)
        
Light Weight Access Point Protocol Radio 
basically ones own AP.       
REFERENCE
        
[1] Wireless LAN Medium Access Control ( MAC ) and
    Physical Layer ( PHY ) Specifications.
        
[2] Draft-obara-capwap-lwapp-00.txt, IETF Light 
    Weight Access Point Protocol.
    

Imported Objects

cLApRogueDot11RadioBand, cLApRogueMode, cLApDot11RadioMACAddress, cLApIfSmtDot11Bssid, cLApDot11RadioChannelNumber, cLApRogueDetectedChannel, cLApDot11IfType, cLApName, cLApRogueApMacAddressCISCO-LWAPP-AP-MIB
cldcClientMacAddressCISCO-LWAPP-DOT11-CLIENT-MIB
ciscoMgmtCISCO-SMI
SnmpAdminStringSNMP-FRAMEWORK-MIB
MODULE-COMPLIANCE, NOTIFICATION-GROUP, OBJECT-GROUPSNMPv2-CONF
NOTIFICATION-TYPE, Unsigned32, Integer32, OBJECT-TYPE, MODULE-IDENTITYSNMPv2-SMI
TEXTUAL-CONVENTION, TruthValue, MacAddress, RowStatus, StorageTypeSNMPv2-TC

Type Definitions (1)

Name Base Type Values/Constraints
CLAutoContainActionsEnumerationalarmOnly(1), contain(2)

Objects

ciscoLwappRogueMIB .1.3.6.1.4.1.9.9.610
ciscoLwappRogueMIBNotifs .1.3.6.1.4.1.9.9.610.0
ciscoLwappRogueMIBObjects .1.3.6.1.4.1.9.9.610.1
cLRogueConfig .1.3.6.1.4.1.9.9.610.1.1
cLRoguePolicyConfig .1.3.6.1.4.1.9.9.610.1.1.1
cLRogueAdhocRogueReportEnable
.1.3.6.1.4.1.9.9.610.1.1.1.1
cLRogueContainAutoRateEnable
.1.3.6.1.4.1.9.9.610.1.1.1.10
cLRogueReportInterval .1.3.6.1.4.1.9.9.610.1.1.1.2
cLRogueMinimumRssi .1.3.6.1.4.1.9.9.610.1.1.1.3
cLRogueTransientInterval .1.3.6.1.4.1.9.9.610.1.1.1.4
cLRogueClientNumThreshold .1.3.6.1.4.1.9.9.610.1.1.1.5
cLRogueDetectionSecurityLevel .1.3.6.1.4.1.9.9.610.1.1.1.6
cLRogueValidateRogueClientsAgainstMse .1.3.6.1.4.1.9.9.610.1.1.1.7
cLRogueValidateRogueApsAgainstAAA .1.3.6.1.4.1.9.9.610.1.1.1.8
cLRogueApPollingInterval .1.3.6.1.4.1.9.9.610.1.1.1.9
cLRogueAdhocRogueNotifEnabled
.1.3.6.1.4.1.9.9.610.1.1.2
cLRogueRuleConfig .1.3.6.1.4.1.9.9.610.1.1.3
cLRuleConfigTable .1.3.6.1.4.1.9.9.610.1.1.3.1
cLRuleConfigEntry .1.3.6.1.4.1.9.9.610.1.1.3.1.1
cLRuleName .1.3.6.1.4.1.9.9.610.1.1.3.1.1.1
cLRuleNotifyType .1.3.6.1.4.1.9.9.610.1.1.3.1.1.10
cLRuleStateType .1.3.6.1.4.1.9.9.610.1.1.3.1.1.11
cLRuleRogueType .1.3.6.1.4.1.9.9.610.1.1.3.1.1.2
cLRuleConditionsMatch .1.3.6.1.4.1.9.9.610.1.1.3.1.1.3
cLRulePriority .1.3.6.1.4.1.9.9.610.1.1.3.1.1.4
cLRuleEnable
.1.3.6.1.4.1.9.9.610.1.1.3.1.1.5
cLRuleStorageType
.1.3.6.1.4.1.9.9.610.1.1.3.1.1.6
cLRuleRowStatus
.1.3.6.1.4.1.9.9.610.1.1.3.1.1.7
cLRuleSeverityScore .1.3.6.1.4.1.9.9.610.1.1.3.1.1.8
cLRuleClassificationName
.1.3.6.1.4.1.9.9.610.1.1.3.1.1.9
cLConditionConfigTable .1.3.6.1.4.1.9.9.610.1.1.3.2
cLConditionConfigEntry .1.3.6.1.4.1.9.9.610.1.1.3.2.1
cLConditionName .1.3.6.1.4.1.9.9.610.1.1.3.2.1.1
cLConditionManagedSsidEnabled
.1.3.6.1.4.1.9.9.610.1.1.3.2.1.10
cLConditionDuration .1.3.6.1.4.1.9.9.610.1.1.3.2.1.11
cLConditionType .1.3.6.1.4.1.9.9.610.1.1.3.2.1.2
cLConditionValue .1.3.6.1.4.1.9.9.610.1.1.3.2.1.3
cLConditionEnable
.1.3.6.1.4.1.9.9.610.1.1.3.2.1.4
cLConditionStorageType
.1.3.6.1.4.1.9.9.610.1.1.3.2.1.5
cLConditionRowStatus
.1.3.6.1.4.1.9.9.610.1.1.3.2.1.6
cLConditionRssi .1.3.6.1.4.1.9.9.610.1.1.3.2.1.7
cLConditionClientCount .1.3.6.1.4.1.9.9.610.1.1.3.2.1.8
cLConditionNoEncryptionEnabled
.1.3.6.1.4.1.9.9.610.1.1.3.2.1.9
cLConditionSsidConfigTable .1.3.6.1.4.1.9.9.610.1.1.3.3
cLConditionSsidConfigEntry .1.3.6.1.4.1.9.9.610.1.1.3.3.1
cLConditionSsidValue .1.3.6.1.4.1.9.9.610.1.1.3.3.1.1
cLConditionSsidStorageType
.1.3.6.1.4.1.9.9.610.1.1.3.3.1.2
cLConditionSsidRowStatus
.1.3.6.1.4.1.9.9.610.1.1.3.3.1.3
cLConditionSsidType .1.3.6.1.4.1.9.9.610.1.1.3.3.1.4
cLRogueIgnoreListConfig .1.3.6.1.4.1.9.9.610.1.1.4
cLRogueIgnoreListTable .1.3.6.1.4.1.9.9.610.1.1.4.1
cLRogueIgnoreListEntry .1.3.6.1.4.1.9.9.610.1.1.4.1.1
cLRogueIgnoreListMACAddress
.1.3.6.1.4.1.9.9.610.1.1.4.1.1.1
cLRogueIgnoreListStorageType
.1.3.6.1.4.1.9.9.610.1.1.4.1.1.2
cLRogueIgnoreListRowStatus
.1.3.6.1.4.1.9.9.610.1.1.4.1.1.3
cLRldpAutoContainConfig .1.3.6.1.4.1.9.9.610.1.1.5
cLRldpAutoContainFeatureOnWiredNetwork .1.3.6.1.4.1.9.9.610.1.1.5.1
cLRldpAutoContainRoguesAdvertisingSsid .1.3.6.1.4.1.9.9.610.1.1.5.2
cLRldpAutoContainAdhocNetworks .1.3.6.1.4.1.9.9.610.1.1.5.3
cLRldpAutoContainTrustedClientsOnRogueAps .1.3.6.1.4.1.9.9.610.1.1.5.4
cLRldpAutoContainLevel .1.3.6.1.4.1.9.9.610.1.1.5.5
cLRldpAutoContainOnlyforMonitorModeAps .1.3.6.1.4.1.9.9.610.1.1.5.6
cLRldpAutoContainFlexStandaloneAp .1.3.6.1.4.1.9.9.610.1.1.5.7
cLRogueApConfig .1.3.6.1.4.1.9.9.610.1.1.6
cLRogueApTable deprecated.1.3.6.1.4.1.9.9.610.1.1.6.1
cLRogueApEntry deprecated .1.3.6.1.4.1.9.9.610.1.1.6.1.1
cLRogueApMACAddress deprecated
.1.3.6.1.4.1.9.9.610.1.1.6.1.1.1
cLRogueApClassType deprecated .1.3.6.1.4.1.9.9.610.1.1.6.1.1.2
cLRogueApState deprecated .1.3.6.1.4.1.9.9.610.1.1.6.1.1.3
cLRogueApStorageType deprecated
.1.3.6.1.4.1.9.9.610.1.1.6.1.1.4
cLRogueApRowStatus deprecated
.1.3.6.1.4.1.9.9.610.1.1.6.1.1.5
cLRogueApListTable .1.3.6.1.4.1.9.9.610.1.1.6.2
cLRogueApListEntry .1.3.6.1.4.1.9.9.610.1.1.6.2.1
cLRogueApMacAddr
.1.3.6.1.4.1.9.9.610.1.1.6.2.1.1
cLRogueApSeverityScore .1.3.6.1.4.1.9.9.610.1.1.6.2.1.2
cLRogueApRuleName
.1.3.6.1.4.1.9.9.610.1.1.6.2.1.3
cLRogueApClassName
.1.3.6.1.4.1.9.9.610.1.1.6.2.1.4
cLRogueClientConfig .1.3.6.1.4.1.9.9.610.1.1.7
cLRogueClientTable .1.3.6.1.4.1.9.9.610.1.1.7.1
cLRogueClientEntry .1.3.6.1.4.1.9.9.610.1.1.7.1.1
cLRogueClientMacAddress
.1.3.6.1.4.1.9.9.610.1.1.7.1.1.1
cLRogueClientGatewayMacAddress
.1.3.6.1.4.1.9.9.610.1.1.7.1.1.2
cLRogueApDetectingApDetails .1.3.6.1.4.1.9.9.610.1.1.8
cLRogueAPDetectingAPTable .1.3.6.1.4.1.9.9.610.1.1.8.1
cLRogueAPDetectingAPEntry .1.3.6.1.4.1.9.9.610.1.1.8.1.1
cLRogueAPDetectingAPMacAddress
.1.3.6.1.4.1.9.9.610.1.1.8.1.1.1
cLRogueAPContainmentChannelCount .1.3.6.1.4.1.9.9.610.1.1.8.1.1.10
cLRogueAPContainmentChannels
.1.3.6.1.4.1.9.9.610.1.1.8.1.1.11
cLRogueAPDetectingAPLastHeard
.1.3.6.1.4.1.9.9.610.1.1.8.1.1.12
cLRogueAPDetectingAPWepMode .1.3.6.1.4.1.9.9.610.1.1.8.1.1.13
cLRogueAPDetectingAPPreamble .1.3.6.1.4.1.9.9.610.1.1.8.1.1.14
cLRogueAPDetectingAPWpaMode .1.3.6.1.4.1.9.9.610.1.1.8.1.1.15
cLRogueAPDetectingAPWpa2Mode .1.3.6.1.4.1.9.9.610.1.1.8.1.1.16
cLRogueAPDetectingAPFTMode .1.3.6.1.4.1.9.9.610.1.1.8.1.1.17
cLRogueAPDetectingAPSNR .1.3.6.1.4.1.9.9.610.1.1.8.1.1.18
cLRogueAPChannelWidth .1.3.6.1.4.1.9.9.610.1.1.8.1.1.19
cLRogueAPDetectingAPSlotId .1.3.6.1.4.1.9.9.610.1.1.8.1.1.2
cLRogueAPPhysicalAPSlot .1.3.6.1.4.1.9.9.610.1.1.8.1.1.20
cLRogueAPRadioType .1.3.6.1.4.1.9.9.610.1.1.8.1.1.3
cLRogueAPDetectingAPName
.1.3.6.1.4.1.9.9.610.1.1.8.1.1.4
cLRogueAPChannelNumber .1.3.6.1.4.1.9.9.610.1.1.8.1.1.5
cLRogueAPSsid
.1.3.6.1.4.1.9.9.610.1.1.8.1.1.6
cLRogueAPHiddenSsid .1.3.6.1.4.1.9.9.610.1.1.8.1.1.7
cLRogueAPDetectingAPRSSI .1.3.6.1.4.1.9.9.610.1.1.8.1.1.8
cLRogueAPContainmentMode .1.3.6.1.4.1.9.9.610.1.1.8.1.1.9
ciscoLwappRogueMIBConform .1.3.6.1.4.1.9.9.610.2
ciscoLwappRogueMIBCompliances .1.3.6.1.4.1.9.9.610.2.1
ciscoLwappRogueMIBGroups .1.3.6.1.4.1.9.9.610.2.2
ciscoLwappRogueMIBNotifObjects .1.3.6.1.4.1.9.9.610.3
cLRogueApContainmentLevel .1.3.6.1.4.1.9.9.610.3.1
cLRogueClientTotalDetectingAPs .1.3.6.1.4.1.9.9.610.3.2
cLRogueClientFirstReported
.1.3.6.1.4.1.9.9.610.3.3
cLRogueClientLastReported
.1.3.6.1.4.1.9.9.610.3.4
cLRogueClientGatewayMac
.1.3.6.1.4.1.9.9.610.3.5
cLLastDetectingRadioMACAddress
.1.3.6.1.4.1.9.9.610.3.6

Notifications/Traps

NameOIDDescription
cLRogueAdhocRogueDetected

.1.3.6.1.4.1.9.9.610.0.1
ication is generated by the controller when a 
a rogue is detected.  The name of the AP that  
detected this rogue is sent in the notification.
cLRogueClientExceededThreshold









.1.3.6.1.4.1.9.9.610.0.2
ication is generated by the controller
when a rogue client exceeds its maximum 
threshold configured. The details of Rogue AP
and Rogue Clients is sent in the notification.
cLRogueExceededClientRemovedThreshold









.1.3.6.1.4.1.9.9.610.0.3
ication is generated by the controller
when a rogue client is removed from the rogue AP 
and still the client count of the rogue AP is greater 
than the maximum threshold configured. The details 
of Rogue AP and Rogue Clients is sent in the 
notification.
cLRogueApRuleContained


.1.3.6.1.4.1.9.9.610.0.4
ication is generated by the controller
when a rogue AP is contained due to Rogue Rule.
cLRogueClientDetected








.1.3.6.1.4.1.9.9.610.0.5
ication is generated by the controller
when a rogue client is detected.