What you have to do is to either impersonate the AP (send deauth messages to the client on behalf of your AP with your AP BSSID as the source MAC) or use floods DoS (authentication floods for example, a client that tries to maliciously send high number of auth requests to the AP and stops at that stage of state machine which will fill the Association table of the AP and prevents other clients form being able to connect).

Here is Cisco WIPS Policy Alarm Encyclopedia:

http://goo.gl/LXBLW5

My question here would be: Do you have a Mobility Service Engine (MSE) in your infrastructure? That's necessary to be available with WIPS service running and that must be integrated with WLCs and NCS/Prime.

Regards,

Amjad

You don't have to run MFP. But you need to make sure that wIPS service is running correctly on on the MSE and MSE, NCS and WLC area all synched.

Have you followed the deployment guide and created wIPS profiles on NCS?

http://goo.gl/MgUxSU

Regards,

Amjad