Network Management

Reply
Contributor II
Posts: 37
Registered: ‎10-27-2011

Airwave keeps logging messages for attacks/vulnerabilities not checked in IDS profile

We are getting hundreds of the "Invalid MAC OUI" events logged in RAPIDS even though the ArubaOS IDS profile doesn't have that particular option checked.

 

I've tried checking it and updating, and then unchecking it and updating again to see if that resolves the issue but this is annoying beyond belief.  I've had to temporarily suspend email from Airwave on alerts because there were so many my inbox was sounding like the door chime on the door to a quarter priced starbucks....

 

Any suggestions?  Otherwise I'll open a support case...

Guru Elite
Posts: 21,488
Registered: ‎03-29-2007

Re: Airwave keeps logging messages for attacks/vulnerabilities not checked in IDS profile


eickst wrote:

We are getting hundreds of the "Invalid MAC OUI" events logged in RAPIDS even though the ArubaOS IDS profile doesn't have that particular option checked.

 

I've tried checking it and updating, and then unchecking it and updating again to see if that resolves the issue but this is annoying beyond belief.  I've had to temporarily suspend email from Airwave on alerts because there were so many my inbox was sounding like the door chime on the door to a quarter priced starbucks....

 

Any suggestions?  Otherwise I'll open a support case...


Well, it is coming from somewhere.  Type "show snmp trap-queue" on the commandline of the controller to see if the controller is indeed sending those traps.  You might have the wrong IDS profile configured.  



Colin Joseph
Aruba Customer Engineering

Looking for an Answer? Search the Community Knowledge Base Here: Community Knowledge Base

Contributor II
Posts: 37
Registered: ‎10-27-2011

Re: Airwave keeps logging messages for attacks/vulnerabilities not checked in IDS profile

Only have one IDS profile.  Trap queue didn't show them but I went ahead and disabled the trap in the snmp config of each controller.  We'll see if that kills it.  

Search Airheads
Showing results for 
Search instead for 
Did you mean: