Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Auth Flood Issue

Hi,

I have 5508 setup with 450 - 3502E APs in our environment. The issue is that we have an auditorium that serves anywhere from 10 to 50 users. The issue is that I have seen that whenever the auditorium has alot of users in it, Auth Flood msgs are being generated.

I will be very grateful if someone can help with Cisco IDS Auth Flood parameters, as in which parameter should be tweaked in order to resolve this issue, without having any effect on the whole network? Furthermore, if someone has Cisco recommendation document on this I will be very grateful.

Thanks

Usama

2 REPLIES
VIP Purple

Auth Flood Issue

Hi Usama,

When you see 'deauth flood' messages this means that an AP is seeing a lot of deauths in the air.  These messages

often happen when a NIC card leaves an area where there there are dense APs.

If you want it to trigger not at all:

Management > Trap Controls > 802.11 Security Traps > IDS Signature Attack

Check the TAC reply for same kind of problem:

https://supportforums.cisco.com/thread/338432

Regards

Dont forget to rate helpful posts.

New Member

Auth Flood Issue

Hi

Thanks for your quick reply. But i am not getting this bug error, I only get these msgs when alot of ppl authenticate and join in the auditorium at the same time.

Furthermore, if i disable it then it will be a global settings and i dont want that to happen. any other suggestion, as in change the Signature Freq. Singature MAC Freq or interval etc, any recommendations from Cisco on this?

Thanks

302
Views
0
Helpful
2
Replies