Wireless Access

last person joined: yesterday 

Access network design for branch, remote, outdoor, and campus locations with HPE Aruba Networking access points and mobility controllers.
Back to discussions
Expand all | Collapse all

Connections issue and Logs

This thread has been viewed 23 times

  • 1.  Connections issue and Logs

    Posted Sep 14, 2019 02:28 PM

    Hi everybody,

    I saw this logs on the controller,

    wms[6003]: <126065> <6003> <WARN> |wms| |ids| AP(90:4c:81:ad:27:e0@90:4c:81:c2:d2:7e): Valid Client Not Using Encryption: An AP detected an unencrypted frame between a valid client (00:10:20:cf:ef:27) and access point (BSSID 90:4c:81:9f:9d:52), with source 00:10:20:cf:ef:27 and receiver 33:33:ff:cf:ef:27. SNR value is 36.

     

    this SSID is using mac address authentication(00:10:20..) with ClearPass,

     

    when appeared this log all the devices with mac 00:10:20.. lost connection for a few seconds.

     

    any know what means this log??

     

     

     



  • 2.  RE: Connections issue and Logs

    EMPLOYEE
    Posted Sep 14, 2019 04:10 PM

    A "Valid Client" is a client that has used encryption on your system.  If the system observes the mac address of the same client not using encryption an open or captive portal SSID on another system for example) it logs that message.  It is nothing to worry about.  You can remove that alert in the IDS settings.



  • 3.  RE: Connections issue and Logs

    Posted Sep 16, 2019 09:01 AM

    Thanks for your answer Cjoseph!!,

     

    Do you know, if after that a "Valid Client" Log, appears this log:

     

    wms[6003]: <126035> <6003> <WARN> |wms| |ids| AP(90:4c:81:ae:40:a0@90:4c:81:c2:e4:0a): Disconnect Station Attack: An AP detected a disconnect attack of client 00:10:20:cf:ef:27 and access point (BSSID 38:17:c3:8e:22:52 and SSID devices on CHANNEL 64). SNR of client is 9. Additional Info: Avg-Deauth-Disassoc-PktRate(pps):0.9; Interval(sec):10.

     

    it´s a desconnection?

     

    thanks!