11-02-2015 03:22 PM
I have a client running AMP 18.104.22.168 and IAP-225 with 22.214.171.124-126.96.36.199 code.
We are getting a large number of Rogue AP detections using a rule which is configured with Detected Wireless and Detected on LAN both enabled.
Some of these devices are quite obviously not rogues and drilling down into the detail of an entry can see that the source of the data is "Wireline Aruba Instant Data"
What is this data? Can it be configured / adjusted to prevent these false rogue detections?
Solved! Go to Solution.
11-03-2015 04:12 AM
Do the access points show up under the Instant's IDS tab? How are they classified on the instant cluster?
Aruba Customer Engineering
Looking for an Answer? Search the Community Knowledge Base Here: Community Knowledge Base
11-04-2015 01:22 PM - edited 11-04-2015 01:23 PM
I just checked on one recent detection and its showing up on the virtual controller as "interfering".
Looking over the logs in airwave it seems the detections from the AP's are showing up as "Wireless Scan" where as the data from the virtual controller is showing up as "Wireline Aruba Instant Data"
11-04-2015 04:54 PM
I had the same false-rogue determination in Airwave and got a patch to turn off the feature while they fix it. TAC said that it was disabled in 188.8.131.52 to return after the kinks are worked out.
if I've helped, please give kudos
if I've provided a solution, please mark the solution so others can find it
11-04-2015 05:05 PM
This sounds like my issue.
Also in release notes:
DE21856 Valid access points marked as neighbors, are no longer incorrectly classified as rogues after upgrading AirWave. The Wireline Aruba Instant Data discovery method for IAPs was removed to prevent this.
Time to upgrade!