Impersonation of AP issue

[gbressanin]

Hi,

i have a WISM with release 6.0 and 150 AP connected all in the same RRM. In the TrapLog I see a lot of |"Impersonation of AP......" messages. This issue is between AP connected to the same WISM and in he same RRM.

Any idea?

Regards

Giovanni

An

[Roman Rodichev]

Do you have "Validate SSID" checked under WLC > Security > Wireless Protection Services > Trusted AP Policies?

[gbressanin]

In my WISM with revision 6.0 installed I don't find the "Trusted AP Policies" under "Wireless Protection Services".

I attach the copy of the security web page.

Bye

Giovanni

[Roman Rodichev]

Is this happening for one specific AP or for many of them?

[gbressanin]

For many of them.

[Roman Rodichev · Accepted solution]

Do you have "AP Authentication" enabled under Security>WPS>APAuth/MFP ? If you do, try disabling it (on both controllers)

Regards,

Roman

[gbressanin]

Hi Roman,

thank you, it was the " AP Authentication Policy" configured as "AP Authentication that generate the error messages. Now I set the Protection Type to " Management Frame Protection" and I not get any error messages.

Thank you again.

Regards

Giovanni

[Roman Rodichev]

Giovanni,

Interesting, that means:

1. Your two controllers don't have matching RF Group names. Double-check.

2. or you could be running into a bug

MFP is definitely a better option :)

Regards,

Roman

[gbressanin]

Hi Roman,

sorry for the late but I'm in vacation. I read now the answer at the case that I opened to the TAC about this issue.

From the case notes which you have added, I can see that you are affected by the bug:

CSCsi18369

AP Auth: Known rogues are reported as impersonation alerts

Symptom:

If AP authentication is enabled, the controller will report the entries in the known AP MAC address

list, as impersonation alerts.

Workaround:

Use MFP or disable AP Authentication

Regards

Giovanni