Wireless " On Wire" Rogue Detection

[Tank]

Hello Everyone, I am curious if anyone has seen similar behaviors related to false reports of " On Wire" Rogue wireless detection. We are in the mist of rolling out hundreds of WiFi90D' s and using the integrated radio for " Rogue" detection. I am beginning to see a lot of " False Positives" in regards to " On Wire" alerts where the Fortinet will initially report an " On Wire" alert and then fifteen minutes later clear the alert. The really strange part about this is the SSID: Huddle House is a restaurant across the street from our location. I have ran network traces on the WAN interfaces of the Fortinet and see broadcasts coming from the suspect AP, which would indicate the DSL modem is in bridge mode, but I have no control over that. To make this worse, we are generating alerts to our Network operation group and they are not too happy at the moment. I am running FortiWiFi90D Firmware 5.0.7 Thanks, George

[ede_pfau]

hi, you could try a local-in policy on the WAN interface blocking all traffic except management services (ssh, https) - if applicable at all. Incoming traffic might only be IPsec or SSL VPN in addition.

[Tank]

Hello Ede, Thanks for the response. Can you elaborate a little more on the " Local-In" policy rule? Thanks, George

[Dave_Hall]

Snipped from the 5.0 CLI Ref manual....

[Tank]

Thanks Dave, I will review the policy options and report back.