You have enabled "rogue AP containment" in the Wireless IPS settings for a company’s HPE Aruba Networking APs. What form of containment does HPE Aruba Networking recommend?

HPE Aruba Networking recommends wired containment as the primary and most effective method for containing rogue APs. This technique identifies the physical switch port to which the rogue AP is connected and disables it, thereby removing the device's access to the corporate network. This approach is preferred because it addresses the root cause of the threat—the unauthorized wired connection—without disrupting the wireless radio frequency (RF) environment or affecting legitimate nearby wireless networks. Wireless containment methods are typically considered secondary options.

A. Wireless deauthentication only: This is an aggressive method that can disrupt legitimate client traffic on nearby networks and may have legal implications. It is not the primary recommended approach.
B. Wireless tarpit and wired containment: While these methods can be used, the question asks for the recommended form. Wired containment is the single most effective and recommended method, not a combination.
C. Wireless tarpit only: Tarpitting is a less disruptive wireless containment method than deauthentication, but it is less effective than wired containment as it only contains clients, not the rogue AP itself.

1. ArubaOS 8.10.0.x User Guide: In the "Wireless Intrusion Prevention" chapter, under the section "Wired Containment for Rogue APs," the guide states, "Wired containment is the most effective method of containing a rogue AP, as it denies the rogue AP access to the wired network." (Page 1018)

2. HPE Aruba Networking Validated Solution Guide - Secure Campus for Midsize Networks: In the "Wireless Intrusion Detection and Prevention" section, the guide outlines the best practice: "If the rogue AP is on the wired network, the best course of action is to perform wired containment. This involves tracing the rogue AP to the switch port it is connected to and shutting down the port." (Chapter: Security, Section: Wireless Intrusion Detection and Prevention)

3. Aruba AirWave 8.2.11 User Guide: The documentation on managing rogue APs prioritizes identifying the device's location on the wired network to facilitate its removal, reinforcing the preference for wired-side mitigation over wireless containment. (Chapter: Monitoring Network Health, Section: Working with Rogues)