Network Management

Hi,

I have a client running AMP 8.0.8.1 and IAP-225 with 6.4.2.6-4.1.1.7 code. 

We are getting a large number of Rogue AP detections using a rule which is configured with Detected Wireless and Detected on LAN both enabled. 

Some of these devices are quite obviously not rogues and drilling down into the detail of an entry can see that the source of the data is "Wireline Aruba Instant Data"

What is this data? Can it be configured / adjusted to prevent these false rogue detections?

 Do the access points show up under the Instant's IDS tab?  How are they classified on the instant cluster?

I just checked on one recent detection and its showing up on the virtual controller as "interfering".

Looking over the logs in airwave it seems the detections from the AP's are showing up as "Wireless Scan" where as the data from the virtual controller is showing up as "Wireline Aruba Instant Data"

I had the same false-rogue determination in Airwave and got a patch to turn off the feature while they fix it. TAC said that it was disabled in 8.0.9.1 to return after the kinks are worked out.

Thanks Matthew,

This sounds like my issue. 

Also in release notes:

DE21856 Valid access points marked as neighbors, are no longer incorrectly classified as rogues after upgrading AirWave. The Wireline Aruba Instant Data discovery method for IAPs was removed to prevent this.

Time to upgrade!

a nice find, i had the same issue but support wanted more proof then we could provide at that stage.

upgrade it is.