How to check IDS re-classification from AirWave to IAP?

Aruba Employee
Q:

How to check IDS reclassification from Airwave to IAP? 

How to check what are the BSSIDs (MAC addresses) reclassified from Airwave to IAP, when IDS reclassification on IAP is done by Airwave? 

 



A:

When IDS reclassification is done from AirWave to IAP, the Airwave pushes the "reclassify" commands to the IAP. 

In InstantOS, we don't have a "show audit-trail" output to check what command have been issued on the IAP. 

 

To check what APs have been reclassified by the Airwave, we need to check the system logs on the IAP. 

show log system

Jun 23 00:41:35  cli[2025]: <341005> <ERRS> |AP 00:0b:86:ee:65:a8@192.168.15.51 cli|  apply_swarm_action_cmd: 3258: cmd='ids-reclassify ap e0:91:f5:d8:16:06 2 6'
Jun 23 01:11:45  cli[2025]: <341005> <ERRS> |AP 00:0b:86:ee:65:a8@192.168.15.51 cli|  apply_swarm_action_cmd: 3258: cmd='ids-reclassify ap 8e:18:d9:78:fb:d0 2 2 ids-reclassify ap bc:67:1c:e8:c5:03 2 2'
Jun 23 01:41:55  cli[2025]: <341005> <ERRS> |AP 00:0b:86:ee:65:a8@192.168.15.51 cli|  apply_swarm_action_cmd: 3258: cmd='ids-reclassify ap 00:26:5a:b5:e2:61 2 2 ids-reclassify ap e8:fc:af:c0:20:a4 2 2 ids-reclassify ap fa:8f:ca:74:1a:8b 2 2'
Jun 23 02:43:16  cli[2025]: <341005> <ERRS> |AP 00:0b:86:ee:65:a8@192.168.15.51 cli|  apply_swarm_action_cmd: 3258: cmd='ids-reclassify ap 10:05:b1:49:26:00 2 6 ids-reclassify ap 38:ff:36:36:a2:9c 1 6 ids-reclassify ap 38:ff:36:76:a2:9c 1 6 ids-reclassify ap 84:1b:5e:cd:54:fd 1 6 ids-reclassify ap 94:10:3e:06:ea:74 1 2 ids-reclassify ap bc
Jun 23 03:12:25  cli[2025]: <341005> <ERRS> |AP 00:0b:86:ee:65:a8@192.168.15.51 cli|  apply_swarm_action_cmd: 3258: cmd='ids-reclassify ap 18:4f:32:da:92:83 1 6 ids-reclassify ap e2:91:f5:d8:16:07 2 6'
Jun 23 03:42:35  cli[2025]: <341005> <ERRS> |AP 00:0b:86:ee:65:a8@192.168.15.51 cli|  apply_swarm_action_cmd: 3258: cmd='ids-reclassify ap 14:ab:f0:cd:d5:80 2 2 ids-reclassify ap bc:67:1c:e4:f6:8c 1 2 ids-reclassify ap e0:91:f5:d8:16:06 2 6 ids-reclassify ap e6:f4:c6:0f:69:65 2 6'
Jun 23 04:13:46  cli[2025]: <341005> <ERRS> |AP 00:0b:86:ee:65:a8@192.168.15.51 cli|  apply_swarm_action_cmd: 3258: cmd='ids-reclassify ap 54:65:de:f7:ba:00 2 2 ids-reclassify ap fa:8f:ca:73:8a:27 2 2'
Jun 23 04:43:56  cli[2025]: <341005> <ERRS> |AP 00:0b:86:ee:65:a8@192.168.15.51 cli|  apply_swarm_action_cmd: 3258: cmd='ids-reclassify ap 14:ab:f0:cd:d5:85 1 2 ids-reclassify ap fa:8f:ca:73:8a:27 2 2'
Jun 23 05:13:05  cli[2025]: <341005> <ERRS> |AP 00:0b:86:ee:65:a8@192.168.15.51 cli|  apply_swarm_action_cmd: 3258: cmd='ids-reclassify ap 10:05:b1:49:26:00 2 6 ids-reclassify ap 40:70:09:7e:fa:f5 1 2 ids-reclassify ap e0:91:f5:d8:16:06 2 6 ids-reclassify ap e8:fc:af:c0:20:a4 2 2'
Jun 23 05:44:16  cli[2025]: <341005> <ERRS> |AP 00:0b:86:ee:65:a8@192.168.15.51 cli|  apply_swarm_action_cmd: 3258: cmd='ids-reclassify ap 00:26:5a:b5:e2:61 2 2 ids-reclassify ap 38:ff:36:36:a2:98 2 6 ids-reclassify ap 40:70:09:7e:fa:f0 2 2 ids-reclassify ap 84:1b:5e:cd:54:fe 2 6 ids-reclassify ap e2:91:f5:d8:16:07 2 6 ids-reclassify ap fa
Jun 23 06:14:26  cli[2025]: <341005> <ERRS> |AP 00:0b:86:ee:65:a8@192.168.15.51 cli|  apply_swarm_action_cmd: 3258: cmd='ids-reclassify ap bc:67:1c:e4:f6:8d 1 2'
Jun 23 06:44:36  cli[2025]: <341005> <ERRS> |AP 00:0b:86:ee:65:a8@192.168.15.51 cli|  apply_swarm_action_cmd: 3258: cmd='ids-reclassify ap 00:26:5a:b5:e2:61 2 2 ids-reclassify ap 38:ff:36:36:a2:98 2 6 ids-reclassify ap 38:ff:36:76:a2:98 2 6 ids-reclassify ap 94:10:3e:06:ea:73 2 2 ids-reclassify ap bc:67:1c:e8:c5:02 2 2 ids-reclassify ap e4
Jun 23 07:13:46  cli[2025]: <341005> <ERRS> |AP 00:0b:86:ee:65:a8@192.168.15.51 cli|  apply_swarm_action_cmd: 3258: cmd='ids-reclassify ap 84:1b:5e:cd:54:fd 1 6'
Jun 23 07:43:56  cli[2025]: <341005> <ERRS> |AP 00:0b:86:ee:65:a8@192.168.15.51 cli|  apply_swarm_action_cmd: 3258: cmd='ids-reclassify ap 18:4f:32:da:92:83 1 6 ids-reclassify ap 94:10:3e:06:ea:74 1 2'
Jun 23 08:14:06  cli[2025]: <341005> <ERRS> |AP 00:0b:86:ee:65:a8@192.168.15.51 cli|  apply_swarm_action_cmd: 3258: cmd='ids-reclassify ap 10:05:b1:49:26:00 2 6 ids-reclassify ap bc:67:1c:e8:c5:00 2 2 ids-reclassify ap e0:91:f5:d8:16:06 2 6'
Jun 23 08:44:16  cli[2025]: <341005> <ERRS> |AP 00:0b:86:ee:65:a8@192.168.15.51 cli|  apply_swarm_action_cmd: 3258: cmd='ids-reclassify ap 00:9c:02:cd:df:58 2 6 ids-reclassify ap e2:91:f5:d8:16:07 2 6'

Since the logs on the IAP can get wrapped up, we can enable a syslog server to push all the logs to the syslog. 

Now, if the IAP is rebooted, all the reclassify MAC addresses pushed from the Airwave from the beginning of the IAP boot time can be captured in the syslogs. 

 

The other command to check the reclassification status is, 

IAP# show ids aps

Unknown Access Points Detected
------------------------------
MAC Address        Network                     Classification  Reclassified  Chan.  Type     Last Seen
-----------        -------                     --------------  ------------  -----  ----     ---------
f0:5c:19:23:56:50  Test-XYZ-Plane              Interfering     no            52     AC 40MZ  06:29:33
9c:1c:12:ba:c0:f3  Aruba-IAP-Test-SSID-12      Interfering     no            1      GN 20MZ  06:32:36
94:b4:0f:4e:b3:30  Internal-A                  Valid           yes           108    AC 40MZ  06:32:35
9c:1c:12:e5:75:91  Guest-SSID-12               Valid           yes           11     GN 20MZ  06:31:32
f0:5c:19:1f:70:76  WiFi-Networks               Suspect-Rogue   no            11     GN 20MZ  06:32:06
18:64:72:f0:84:92  Voice-WPA-PSK               Valid           yes           6      GN 20MZ  06:32:31
18:64:72:f9:c7:52  EmployeeNetwork             Valid           yes           100    AC 40MZ  06:32:35
Version history
Revision #:
2 of 2
Last update:
‎03-29-2017 12:04 PM
Updated by:
 
Labels (1)
Contributors
Search Airheads
cancel
Showing results for 
Search instead for 
Did you mean: