Wireless Access

Reply
New Contributor

Connections issue and Logs

Hi everybody,

I saw this logs on the controller,

wms[6003]: <126065> <6003> <WARN> |wms| |ids| AP(90:4c:81:ad:27:e0@90:4c:81:c2:d2:7e): Valid Client Not Using Encryption: An AP detected an unencrypted frame between a valid client (00:10:20:cf:ef:27) and access point (BSSID 90:4c:81:9f:9d:52), with source 00:10:20:cf:ef:27 and receiver 33:33:ff:cf:ef:27. SNR value is 36.

 

this SSID is using mac address authentication(00:10:20..) with ClearPass,

 

when appeared this log all the devices with mac 00:10:20.. lost connection for a few seconds.

 

any know what means this log??

 

 

 

Guru Elite

Re: Connections issue and Logs

A "Valid Client" is a client that has used encryption on your system.  If the system observes the mac address of the same client not using encryption an open or captive portal SSID on another system for example) it logs that message.  It is nothing to worry about.  You can remove that alert in the IDS settings.


*Answers and views expressed by me on this forum are my own and not necessarily the position of Aruba Networks or Hewlett Packard Enterprise.*
ArubaOS 8.4 User Guide
InstantOS 8.3 User Guide
Airheads Knowledgebase
Airheads Learning Videos
Aruba Central Documentation
Sign up for Security Alerts
Aruba Technical Webinars
New Contributor

Re: Connections issue and Logs

Thanks for your answer Cjoseph!!,

 

Do you know, if after that a "Valid Client" Log, appears this log:

 

wms[6003]: <126035> <6003> <WARN> |wms| |ids| AP(90:4c:81:ae:40:a0@90:4c:81:c2:e4:0a): Disconnect Station Attack: An AP detected a disconnect attack of client 00:10:20:cf:ef:27 and access point (BSSID 38:17:c3:8e:22:52 and SSID devices on CHANNEL 64). SNR of client is 9. Additional Info: Avg-Deauth-Disassoc-PktRate(pps):0.9; Interval(sec):10.

 

it´s a desconnection?

 

thanks!

 

Search Airheads
cancel
Showing results for 
Search instead for 
Did you mean: