Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

AP impersonation - What do I do?

For the last two weeks I have been getting AP impersonation warnings. What do I do about this? Do I need to do something to protect myself?

1 ACCEPTED SOLUTION

Accepted Solutions
Silver

Re: AP impersonation - What do I do?

Upto my knowledge, this warning means that an unknown 802.11 entity seems to be sending 802.11 frames that are normally expected from one of the controller's APs.

This is only cosmetic and does not affect the network.

Workaround can be the following

(1) On the controller cli:

show advanced 802.11a monitor

For example, it may look like:

Default 802.11a AP monitoring

802.11a Monitor Mode........................... enable

802.11a Monitor Channels....................... Country channels

802.11a AP Coverage Interval................... 180 seconds

802.11a AP Load Interval....................... 60 seconds

802.11a AP Noise Interval...................... 180 seconds

802.11a AP Signal Strength Interval............ 60 seconds

(2) If "802.11a monitor channels" is set to "All Channels", then set it to "country" channels:

config advanced 802.11a monitor channel-list country

Confirm the change using the show cmd in (1).

And then check if the AP impersonation alarms are still raised when monitoring is set to only "Country Channels". If the alarms are still raised, then additional debugs may be collected with the help of TAC.

1 REPLY
Silver

Re: AP impersonation - What do I do?

Upto my knowledge, this warning means that an unknown 802.11 entity seems to be sending 802.11 frames that are normally expected from one of the controller's APs.

This is only cosmetic and does not affect the network.

Workaround can be the following

(1) On the controller cli:

show advanced 802.11a monitor

For example, it may look like:

Default 802.11a AP monitoring

802.11a Monitor Mode........................... enable

802.11a Monitor Channels....................... Country channels

802.11a AP Coverage Interval................... 180 seconds

802.11a AP Load Interval....................... 60 seconds

802.11a AP Noise Interval...................... 180 seconds

802.11a AP Signal Strength Interval............ 60 seconds

(2) If "802.11a monitor channels" is set to "All Channels", then set it to "country" channels:

config advanced 802.11a monitor channel-list country

Confirm the change using the show cmd in (1).

And then check if the AP impersonation alarms are still raised when monitoring is set to only "Country Channels". If the alarms are still raised, then additional debugs may be collected with the help of TAC.

380
Views
0
Helpful
1
Replies