MFP Anomaly Detected

[Alejandro.Angon]

Hi,

I have seen this messege log on WLC 5508 running 7.5 code, but I haven´t found any information about it, I will be gratful if any body know what it means

thanks

MFP Anomaly Detected - 3 Not encrypted event(s) found as violated by the radio XX:XX:XX:XX:XX:XX and detected by the dot11 interface at slot 0 of AP XX:XX:XX:XX:XX:XX in 300 seconds when observing Disassoc, Deauth. Client's last source mac XX:XX:XX:XX:XX:XX

[Rasika Nayanajith]

Hi Saravanan,

Does this first bug is internal, cannot see the detail due to no priviledes ?

Regards

Rasika

[Saravanan Lakshmanan]

Yes, it was but I made it external, will take 24hrs or so to be external visible. Anyway, both bugs addresses the same issue.

[Rasika Nayanajith]

Thanks for the update Saravanan

[Rasika Nayanajith]

Hi Saravanan,

checked it again toady & still no visibility of  CSCum49200, still may be internal to Cisco.

Pls check that.

Rasika

[Saravanan Lakshmanan]

i checked now and able to see.

Mac wireless clients in RUN state sometimes unable to ping gateway

CSCum49200

Description

Symptom:Sometimes MAC clients will be associated and RUN state but unable to ping the gateway

Conditions:WLC running 7.6.100.0 with three ap3600s

Workaround:none

More Info:see description

[Scott Fella]

Good deal.... its visable now.

Thanks,

Scott

Help out other by using the rating system and marking answered questions as "Answered"

[Saravanan Lakshmanan]

adding an related defect:

CSCuj17283 WiFi clients dropping ARP  replies on TID 3 w/ ap3700 (on some switches)

Workaround:

Change WLAN QoS profile to Voice, Video or Background (not Best Effort)

[Scott Fella]

Thanks for the update!

Thanks,

Scott

Help out other by using the rating system and marking answered questions as "Answered"

[George Stefanick]

Glad to see that you guys could reproduce it ..

__________________________________________________________________________________________
"Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin
__________________________________________________________________________________________
‎"I'm in a serious relationship with my Wi-Fi. You could say we have a connection."

[Scott Fella]

George,

I think we need to follow up with them just to see if they have another ticket created from our testing. I sent them my config so they can test as close to my environment as possible.

Sent from Cisco Technical Support iPhone App

[Saravanan Lakshmanan]

#Appreciate you guys on bringing in hot issues.

#For issue recreation, the credit goes to an BU escalation.

[Joseph Rizzo]

I have upgraded to 7.6.100 on my 5508 and 2504's. The rogue detection is working much better and I am not getting the MFP errors anymore, I have 1250, 1040 and 1140 LWAP's. Not sure if clients continue to hang and get discontinected,but its been about a week, so no news is good news.

[maerz-helpdesk]

Hello,

this weekend we updated the WLC from our customer to 7.6.100 and also get messages from WCS with MFP Anomaly detection.

The Customer will disable MFP under the WLAN configuration.

I hope this will help and stop these messages.

The global MFP Protection was disabled.

[Scott Fella]

I get those messages still and MFP is disabled on my WLAN's.

Sent from Cisco Technical Support iPhone App

[Scott Fella]

Thanks for the update... George and I have been working with a few guy's on your end with the issues we were seeing.

Thanks,

Scott

Help out other by using the rating system and marking answered questions as "Answered"