Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Fortinet white logo
Fortinet docs logo DOCUMENT LIBRARY
Products Best Practices Hardware Guides Products A-Z
Summary
By Solution
By 4D Pillars
By Cloud
Secure Networking
Unified SASE
Security Operations
Secure SD-WAN
Secure Access Service Edge (SASE)
ZTNA
LAN Edge
Identity and Access Management
Next Generation Firewall
Public Cloud
Private Cloud
FortiCloud
Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
    • More >>
    Unified SASE
  • Single Vendor SASE
  • Cloud Network Security
  • Secure Endpoint Connectivity
  • Web Application / API Protection
    • More >>
    Security Operations
  • Security Operations Automation
  • Identity
  • Early Detection & Prevention
    • More >>
    Secure Networking
  • Hybrid Mesh Firewall
  • NOC Management
  • LAN
  • WAN
  • Communication & Surveillance
    • Unified SASE
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Cloud Network Security
  • Cloud-Native Security
  • Web Application / API Protection
    • Security Operations
  • Security Operations Automation
  • Endpoint
  • Data Protection
  • Identity
  • Email
  • Early Detection & Prevention
  • Expert Services
  • Edge Firewall
  • Orchestration & management
  • SD Branch
  • Application Delivery
  • Single Vendor SASE
  • Secure Endpoint Connectivity
  • Secure Private Access
  • Thin Edge
  • Identity
  • Application Gateway
  • Enterprise Asset Management
  • Endpoint Agent
  • Agentless Security Posture
  • Identity
  • Wireless
  • Switching
  • Identity
  • Privilege Acccess Management
  • Next Generation Firewall
  • Orchestration & management
  • Expert Services
  • All
  • All
  • Account Management
  • SAAS Management
  • SAAS Application Security
  • Managed Services
  • Platform as a service (PAAS)
  • Other SAAS Services
    • 4D Resources
    Solution Hubs
  • 4D Pillars
  • Cloud
  • Popular Solutions

    • Administration Guide

    Home FortiManager 7.2.1 Administration Guide
    7.2.1
    7.6.1
    7.6.0
    7.4.5
    7.4.4
    7.4.3
    7.4.2
    7.4.1
    7.4.0
    7.2.8
    7.2.7
    7.2.6
    7.2.5
    7.2.4
    7.2.3
    7.2.2
    7.2.1
    7.2.0
    7.0.13
    7.0.12
    7.0.11
    7.0.10
    7.0.9
    7.0.8
    7.0.7
    7.0.6
    7.0.5
    7.0.4
    7.0.3
    7.0.2
    7.0.1
    7.0.0
    6.4.15
    6.4.14
    6.4.13
    6.4.12
    6.4.11
    6.4.10
    6.4.9
    6.4.8
    6.4.7
    6.4.6
    6.4.5
    6.4.4
    6.4.3
    6.4.2
    6.4.1
    6.4.0
    6.2.13
    6.2.12
    6.2.11
    6.2.10
    6.2.9
    6.2.8
    6.2.7
    6.2.6
    6.2.6
    6.2.5
    6.2.3
    6.2.2
    6.2.1
    6.2.0
    6.0.12
    6.0.11
    6.0.10
    6.0.9
    6.0.8
    6.0.7
    6.0.6
    6.0.5
    6.0.4
    6.0.3
    6.0.2
    6.0.1
    6.0.0
    5.6.11
    5.6.10
    5.6.9
    5.6.8
    5.6.7
    5.6.6
    5.6.5
    5.6.4
    5.6.3
    5.6.2
    5.6.1
    5.6.0
    5.4.7
    5.4.6
    5.4.5
    5.4.4
    5.4.3
    5.4.2
    5.4.1
    5.4.0
    5.2.10
    5.2.7
    5.2.6
    5.2.4
    5.2.3
    5.2.2
    5.2.1
    5.2.0
    5.0.12
    5.0.11
    5.0.10
    5.0.9
    5.0.8
    5.0.7
    5.0.6
    5.0.5
    5.0.4
    5.0.3
    5.0.2
    4.3.8
    4.3.7
    4.3.6
    4.3.5
    4.3.4
    4.3.3
    4.3.2
    4.3.1
    4.3.0
    4.2.9
    4.2.8
    4.2.7
    4.2.6
    4.2.5
    4.2.4
    4.2.3
    4.2.2
    4.2.1
    4.2.0
    4.1.0
    4.0.3
    4.0.2
    4.0.1
    4.0.0

    Rogue APs

    Rogue APs

    You can use Rogue AP detection to scan for and identify unauthorized wireless access points in the area. Detected APs are displayed in the View Rogue APs table where you can view details about the AP, including the SSID and network status. Rogue APs connected to your wired network can be identified using the On-Wire column in the table.

    For more information about Rogue AP detection, see the FortiAP/FortiWiFi Configuration Guide.

    To view Rogue APs:
    1. Go to AP Manager .
    2. In the tree menu, go to Device & Groups.
    3. In the toolbar, click More > View Rogue APs. The rogue AP list is displayed.

    The following options are available:

    Mark As

    Mark a rogue AP as:

    • Accepted: for APs that are an authorized part of your network or are neighboring APs that are not a security threat.
    • Rogue: for unauthorized APs that On-wire status indicates are attached to your wired networks.
    • Unclassified: the initial status of a discovered AP. You can change an AP back to unclassified if you have mistakenly marked it as Rogue or Accepted.

    Suppress AP

    Suppress the selected APs. This will prevent users from connecting to the AP. When suppression is activated against an AP, the controller sends deauthentication messages to the rogue AP’s clients posing as the rogue AP, and also sends deauthentication messages to the rogue AP posing as its clients.

    Before enabling this feature, verify that operation of Rogue Suppression is compliant with the applicable laws and regulations of your region.

    Unsuppress AP

    Turn of suppression for the selected rogue APs.

    Refresh

    Refresh the rogue AP list.

    Column Settings

    Click to select which columns to display or select Reset to Default to display the default columns.

    The following columns are available:

    State

    The state of the AP:

    • Suppressed: red suppressed icon
    • Rogue: orange rogue icon
    • Accepted: green wireless signal mark
    • Unclassified: gray question mark

    Status

    Whether the AP is active (green) or inactive (orange).

    SSID

    The wireless service set identifier (SSID) or network name for the wireless interface.

    Security Type

    The type of security currently being used.

    Channel

    The wireless radio channel that the access point uses.

    MAC Address

    The MAC address of the wireless interface.

    Vendor Info

    The name of the vendor.

    Signal Strength

    The relative signal strength of the AP.

    Detected By

    The name or serial number of the AP unit that detected the signal.

    On-Wire

    A green up-arrow indicates a suspected rogue, based on the on-wire detection technique. An orange down-arrow indicates AP is not a suspected rogue.

    First Seen

    How long ago this AP was first detected. This column is not visible by default.

    Last Seen

    How long ago this AP was last detected. This column is not visible by default.

    Rate

    The data rate in, bps. This column is not visible by default.
    Previous
    Next

    Rogue APs

    Rogue APs

    You can use Rogue AP detection to scan for and identify unauthorized wireless access points in the area. Detected APs are displayed in the View Rogue APs table where you can view details about the AP, including the SSID and network status. Rogue APs connected to your wired network can be identified using the On-Wire column in the table.

    For more information about Rogue AP detection, see the FortiAP/FortiWiFi Configuration Guide.

    To view Rogue APs:
    1. Go to AP Manager .
    2. In the tree menu, go to Device & Groups.
    3. In the toolbar, click More > View Rogue APs. The rogue AP list is displayed.

    The following options are available:

    Mark As

    Mark a rogue AP as:

    • Accepted: for APs that are an authorized part of your network or are neighboring APs that are not a security threat.
    • Rogue: for unauthorized APs that On-wire status indicates are attached to your wired networks.
    • Unclassified: the initial status of a discovered AP. You can change an AP back to unclassified if you have mistakenly marked it as Rogue or Accepted.

    Suppress AP

    Suppress the selected APs. This will prevent users from connecting to the AP. When suppression is activated against an AP, the controller sends deauthentication messages to the rogue AP’s clients posing as the rogue AP, and also sends deauthentication messages to the rogue AP posing as its clients.

    Before enabling this feature, verify that operation of Rogue Suppression is compliant with the applicable laws and regulations of your region.

    Unsuppress AP

    Turn of suppression for the selected rogue APs.

    Refresh

    Refresh the rogue AP list.

    Column Settings

    Click to select which columns to display or select Reset to Default to display the default columns.

    The following columns are available:

    State

    The state of the AP:

    • Suppressed: red suppressed icon
    • Rogue: orange rogue icon
    • Accepted: green wireless signal mark
    • Unclassified: gray question mark

    Status

    Whether the AP is active (green) or inactive (orange).

    SSID

    The wireless service set identifier (SSID) or network name for the wireless interface.

    Security Type

    The type of security currently being used.

    Channel

    The wireless radio channel that the access point uses.

    MAC Address

    The MAC address of the wireless interface.

    Vendor Info

    The name of the vendor.

    Signal Strength

    The relative signal strength of the AP.

    Detected By

    The name or serial number of the AP unit that detected the signal.

    On-Wire

    A green up-arrow indicates a suspected rogue, based on the on-wire detection technique. An orange down-arrow indicates AP is not a suspected rogue.

    First Seen

    How long ago this AP was first detected. This column is not visible by default.

    Last Seen

    How long ago this AP was last detected. This column is not visible by default.

    Rate

    The data rate in, bps. This column is not visible by default.
    Previous
    Next