Security

Does anyone know what the rf parameters are for location discovery in Airgroup?  For example what are the rf thresholds that are chosen which decide whether or not a bonjour device is advertised?  Also will this service (right now we are allowing sharing within a specific AP group) be advertised to other AP's not within that specific AP group but within the a reasonably close distance RF wise?

 

 

Thanks for the info!

 

 

RF parameters are not taken into account. It is simply based on either AP group or the AP itself. If your buildings are very close, you should add in the neighboring buildings as allow locations for the device.

Maybe I don't have a fair understanding of what location discovery does.  I was under the impression that it allowed the capability of only advertising devices to users that were within  range of the bonjour servers.  Am I wrong?

 

Yes, but its solely based on the AP-group or the AP name. So you have to be associated to an AP in that group or the AP that is specifically named in order to see the advertised service(s)

So then if it is disabled then it is visible to all devices on the Airgroup allowed Vlans.  Correct?

Other AirGroup filters/restrictions would still be in effect (user roles, user groups, and time of day)

 

If none of those are in place:

 

• Devices registered as personal will only be seen by the owner.
• Device registered as shared will be seen by anyone.

That information helps alot.  I'm having some issues with a group of Apple TV's that are only shared with one AP group, but are being seen and are available for mirroring  by clients in a completely different AP group.  The AP's are grouped by building and we can walk across the street, associate with an AP in a completely different group and mirror to the devices.

Do you have enforce registration enabled for AirGroup?

Yes

Are you seeing the AirGroup authorization messages in Access Tracker in CPPM?

 

Can you confirm the context information is visible on the controller?

 

show airgroup cppm entries

 

Yes, they show up as entries in the controller, only being shared with the one specific AP group.

OK. I would open a TAC case then.

I appreciate the help!

 

Not a problem. Please report back if TAC resolves this issue!