Network Management

I am trying to configure rogue detection on Airwave.  Currently on my controller, it is reporting 12 Rogues on the wire at 100%.  I created a rule in Airwave to "Use Controller Classification", Detected on WLAN, Controller Classification="Rogue".  However, I'm not getting any Rogues reported in Airwave.

Any ideas?

Hi, Just add Controller Classification as the condition in the RPAIDS rules.

Detected on WAN + Controller classification means the AP has to met both conditions, if either is no met you wont see any Rogues. to have exat controller classification, Just use one condition and make sure the controller is added to Airwave with ROgue AP polling enabled in the group settings.

Thanks so much for the reply.  I validated my settings and still no luck on getting Rogue notifications.  See attached screenshots of my configs.  I have another Airwave setup at another location with the same settings and everything is working so I'm not for sure what I'm missing here.

Thanks!

Rogues are getting discovered in Airwave but not matching with controller or no rogues getting discovered?

Did you enable poll local controller option under Rapids>Setup page?

Rogues are being discovered on the controller, but are not showing up in Airwave.

Yes, Poll local controllers is enabled under RAPIDS setup.

See attached...

Thanks!

If rogues itself not discovering in Airwave then need to check if any service is down, under system>status page we see all services status , check if AP watcher service or any other service showing down?

No services are showing down...the below services are disabled:

AMON DTLS Receiver

AW10Migration

Cisco ACS

Cisco WLSE Poller

Dead Letter Exchange Consumer

ElasticSearch

Failover Monitor

FTP Server

Glass Feeder

IGC

Logstash

Master Console

NTP Client

Parallel HTTP Fetcher

RADIUS Accounting Server

RTLS Collector

Safe Migration Parallel Worker

sFlow API

Are you seeing any snmp thin_ap_rogue timeouts under Controller's Device>Monitor page event section in Airwave? If YES try increase snmp timeout/retries values in Devices Setup > Communication page and poll the controller also try restart AMP services once from system>status page if you are not seeing any timeouts.

No,  I am not seeing any snmp thin_ap_rogue timeouts in the logs.  I did a complete reboot of the server but still nothing.

To check if any rogue data is been sent to Airwave or not, we can do snoop for thin_ap_rogue topic wait for few minutes and stop the snoop. Collect the snoop file from Download File CLI option.

Go to Advanced> Enter Commands

$snoop thin_ap_rogue

Wait for few minutes

$snoop stop thin_ap_rogue

Download file from Files> Download File > (snoop_thin_ap_rogue.txt) file.

If no rogue data is been sent from controller/IAP open Aruba controller/IAP TAC tikcet .

Did you get anywhere on this issue? I'm having the same problem. IAP Rogue info is populated, but nothing from controllers getting into AirWave. I've had a TAC case open with both the AOS and Airwave teams for UCC data not populating, I've now updated them both to include the same issue with RAPIDs data not populating. FYI we have AOS and Airwave setup with SNMPv3, so it's sending SNMPv3 informs vs SNMPv2 Traps, not sure if that is part of the issue?