IDS Events of IAP in Airwave

[Sairam_sify]

Hi There,

I discovered IAP in Airwave 8.2.6.1 in monitor-only mode. I can able to see only IDS events releated to Rogue AP event. All other IAP IDS detections(like client attacks, Valid SSID violation, AP spoofing etc.. ) data is not getting reflected. Did i missed any settings?

[cjoseph]

Did you configure anything for detection on the IAP?  https://www.arubanetworks.com/techdocs/Instant_423_WebHelp/InstantWebHelp.htm#UG_files/IDS/ConfiguringWIP.htm%3FTocPath%3DUG%2520topics%7CIntrusion%2520Detection%2520System%7C_____3

[Sairam_sify]

Thanks cj,

I have enabled all IDS/IPS settings in IAP.

I have seen IDS data gettings reflected in old Airwave servers(below snapshot). Did airwave removed this feature?

[Pavan Arshewar]

Does old server have only single IAP added?  I beleive those IDSs events generated from multiple IAPs if I am not wrong.

check bleow command on IAP to configure and display state

#ids

#show ap monitor ids-state

[Sairam_sify]

Hi Pavan,

Everything correctly configured in IAP.

my only query is, will Airwave 8.2.6.1 IDS events supports IDS activities (like Client attacks, AP spoofing etc..) other than Rogue activity? Because, i am only able to see only rogue activity in IDS events tab.

Thanks!!

[Pavan Arshewar · Accepted solution]

Airwave supports IDS events