WIPS locates a rogue AP bridged onto a city-hall switch closet and advertising a look-alike staff SSID. Per policy, which containment approach is most appropriate?

A rogue AP bridged onto a city-hall switch closet and advertising a look-alike staff SSID creates both a wireless evil-twin risk and a wired bridging path into municipal VLANs. Policy-aligned containment therefore addresses both planes: shut down the switchport feeding the rogue to remove the wired attachment, and apply authorized WIPS wireless containment against its BSSID so clients are discouraged from associating while responders finish removal. Merely renaming the legitimate SSID leaves the wired bridge intact and does not stop clients from joining the impostor. Emailing employees a rogue WEP key (or any rogue credential) is unsafe and operationally useless as containment. Increasing DHCP lease time does not locate, disconnect, or quarantine a wired rogue. Exam caveat: wireless containment must be authorized and carefully scoped—misapplied containment can disrupt legitimate BSS operation; wired port shutdown is often the fastest definitive step for closet-attached rogues. Operational check: correlate WIPS location with switch MAC/port data, disable the offending port, confirm the rogue BSSID disappears or is contained, document chain of custody for the hardware, and review how an unauthorized device obtained closet access. Update the municipal rogue-response runbook with the dual wired/wireless checklist used in this event.