How can I prevent these two issues:
1- Someone connecting an unauthorized Access Point in my network (plugging an ethernet wire on the wall, but with different SSID from mine, using his own NATting).
2- Someone running an Access Point with my SSID (even if not plugged in my ethernet wiring, trying to fool my clients and potentially doing some MITM attack, it could even be across the street )
For “1” I could just allow only authorized MAC addresses in my network, but I guess there might be a better idea.
For “2” , probably I can set some Mikrotik AP for “scanning” and using a script to read the known MAC addresses on my authorized APs, and then report to syslog if a new AP with my SSID is detected, with a different MAC not on my list.
Not ideal solutions, but thats all I can think for now.
Any suggestions?, how you guys do it? (in a scalable way, without having to walk around with a laptop scanning physical locations)