Network Management

Reply
Super Contributor II
Posts: 358
Registered: ‎02-22-2011

Airwave Rogue AP detection with Instant

Hi,

 

I have a client running AMP 8.0.8.1 and IAP-225 with 6.4.2.6-4.1.1.7 code. 

 

We are getting a large number of Rogue AP detections using a rule which is configured with Detected Wireless and Detected on LAN both enabled. 

 

Some of these devices are quite obviously not rogues and drilling down into the detail of an entry can see that the source of the data is "Wireline Aruba Instant Data"

 

What is this data? Can it be configured / adjusted to prevent these false rogue detections?

 

ampsnip.png

 

Guru Elite
Posts: 21,537
Registered: ‎03-29-2007

Re: Airwave Rogue AP detection with Instant

 Do the access points show up under the Instant's IDS tab?  How are they classified on the instant cluster?



Colin Joseph
Aruba Customer Engineering

Looking for an Answer? Search the Community Knowledge Base Here: Community Knowledge Base

Super Contributor II
Posts: 358
Registered: ‎02-22-2011

Re: Airwave Rogue AP detection with Instant

[ Edited ]

I just checked on one recent detection and its showing up on the virtual controller as "interfering".

Looking over the logs in airwave it seems the detections from the AP's are showing up as "Wireless Scan" where as the data from the virtual controller is showing up as "Wireline Aruba Instant Data"

 

snip-ids.png

MVP
Posts: 732
Registered: ‎12-01-2010

Re: Airwave Rogue AP detection with Instant

I had the same false-rogue determination in Airwave and got a patch to turn off the feature while they fix it. TAC said that it was disabled in 8.0.9.1 to return after the kinks are worked out.

--Matthew

if I've helped, please give kudos
if I've provided a solution, please mark the solution so others can find it
Super Contributor II
Posts: 358
Registered: ‎02-22-2011

Re: Airwave Rogue AP detection with Instant

Thanks Matthew,

 

This sounds like my issue. 

 

Also in release notes:

 

DE21856 Valid access points marked as neighbors, are no longer incorrectly classified as rogues after upgrading AirWave. The Wireline Aruba Instant Data discovery method for IAPs was removed to prevent this.

 

Time to upgrade!

MVP
Posts: 1,414
Registered: ‎11-30-2011

Re: Airwave Rogue AP detection with Instant

a nice find, i had the same issue but support wanted more proof then we could provide at that stage.

 

upgrade it is.

Search Airheads
Showing results for 
Search instead for 
Did you mean: