Wireless Access

We faced with exact same situation but longer period and the same records in the Airwave logs.

When you say "faced with exact same situation", what do you mean?

Valid client misassociation by default is not enabled, so disabling will stop the message.

We faced with exact same situation but longer period and the same records in the Airwave logs.

Hello Cjoseph,

I was trying to reply Niirraaj's entry but I think Aruba portal does not work like that.

Neverthless, we faced exact same problem in a remote location; Wi-Fi went down for 30 minutes and when we check the logs of Airwave we saw the same messages on some APs' IDS logs and their severity is Highest.

I wonder if anyone has attempted to compromise our Wi-Fi system and how to respond to such actions.

Thank you.

When you say "faced with exact same situation", what do you mean?

Valid client misassociation by default is not enabled, so disabling will stop the message.

We faced with exact same situation but longer period and the same records in the Airwave logs.

Understood.  Sometimes the reply actually places the reply under the previous posts.  I'm not sure why it doesn't work.

Valid Client Misassociation is supposed to track clients that have  historically connected to your network with encryption.  It is optional and doesn't have to be enabled.  The message will show up:

• If that  client has connected to an access point that is considered a rogue by your network
• If that client is connected to an access point that is not on your system
• If that client is connected to a hotspot
• If that client is connected to an ad-hoc network

The description of the capability is here:  https://www.arubanetworks.com/techdocs/ArubaOS_8.10.0_Web_Help/Content/arubaos-solutions/wireless-intrus-prev/unde-clie-intr-dete.htm?Highlight=valid%20client%20misassociation#new_wip_1365762209_1030322

This message will show up if you have any of your clients connecting to an external access point, which is pretty generic and doesn't automatically mean an attack is happening.

Hello Cjoseph,

I was trying to reply Niirraaj's entry but I think Aruba portal does not work like that.

Neverthless, we faced exact same problem in a remote location; Wi-Fi went down for 30 minutes and when we check the logs of Airwave we saw the same messages on some APs' IDS logs and their severity is Highest.

I wonder if anyone has attempted to compromise our Wi-Fi system and how to respond to such actions.

Thank you.

When you say "faced with exact same situation", what do you mean?

Valid client misassociation by default is not enabled, so disabling will stop the message.

We faced with exact same situation but longer period and the same records in the Airwave logs.