How to detect Rogue Access Points on Omada Controller

Contents

Introduction

Requirements

List Rogue Access Points

Conclusion

QA

Introduction

A rogue Access Point(AP for short) is any access point installed on your network without authorization. The Rogue AP Detection feature enables your adopted Access points to scan for and display these unauthorized devices, helping you maintain network security by identifying potential vulnerabilities.

Requirements

This article applies to Omada Controller firmware version 5.15 and higher.

• Omada Software/Software Controller firmware version 5.15 and higher
• Omada Standard Central version 5.15 and higher

Note: This feature is not available on Omada Essentials Controller

List Rogue Access Points

Step 1: Log in to the Omada Controller and navigate to the Site’s page. From the left-hand menu, click on Insights and select Rogue APs from the pop-up menu.

Step 2: Scan for the complete Rogue AP list

Conclusion

This article shows how to use the Omada Controller's Rogue AP feature, which identifies and lists detected rogue Access Points.

Get to know more details of each function and configuration please go to Download Center to download the manual of your product.

QA

Q1. What is Rogue AP detection?

A1. The Rogue AP Detection feature is used solely for collecting information about nearby wireless networks. It does not impact the detected Access Points, regardless of the operations you have executed in this feature.

Q2. Why is it possible to add a Rogue Access Point to a trusted list in Standalone Mode, but this functionality is not available when operating under Controller Mode?

A2. The Omada Controller identifies Rogue Access Points by listing any Access Point that is not adopted into your managed network as untrusted. These will then be visible under the Rogue APs list.

Q3. Can I block a Rogue Access point?

A3. Omada Controller provides detection and a list of "Rogue APs.” It does not offer a native capability to actively "block" or disrupt a rogue Access Point's operation. The “Rogue APs” list includes all Access Points observed by the controller, potentially including those belonging to neighboring networks. Although direct blocking of these external Access Points is not supported, strategies can be implemented to prevent your internal wireless clients from connecting to them.

Q4. How to prevent wireless clients from connecting to a Rogue Access Point?

A4. To prevent wireless clients from connecting to unauthorized (rogue) Access Points, we recommend the following best practices:

• Avoid Unsecured Networks: Advise users to refrain from connecting to any unsecured wireless networks.
• Strengthen Wireless Security: If using WPA2-Personal/PSK, ensure strong, unique passphrases are in use. Whenever possible, utilize WPA3 or WPA2-Enterprise. Additionally, consider configuring MAC-Based Authentication for your wireless clients.
• Manage Client Wi-Fi: Instruct users to "forget" or delete unnecessary saved Wi-Fi networks (especially public ones) on their devices. This helps prevent automatic reconnections to rogue APs impersonating legitimate SSIDs. Additionally, advise against enabling automatic Wi-Fi connections for unverified networks.
• Implement Wired Network Access Control: Utilize Network Access Control (NAC) and 802.1X authentication on your wired network ports. This step prevents unauthorized devices, including rogue Access Points, from gaining access to your internal wired infrastructure and subsequently bridging to the internet or internal resources.