Chapter 1 FAQs and Troubleshooting
Intrusion Detection System FAQs and Troubleshooting
Q.I understand that WLSE does not accept SNMP traps that indicate an AP detected a rogue. So why is an AP that is currently designated as the WDS generating rogue AP SNMP traps?
A.The AP is generating the detected rogue trap, not the WDS functionality currently operating within the AP. This trap is based on authentication tattletale rogue detection, which is currently not reported to the WLSE.
WLSE uses radio measurements to detect the rogues. The authentication tattletale method uses a message sent from a participating client that indicates some type of authentication issue with some other AP. This other AP is considered to be rogue for one of these reasons:
–The rogue was not running 802.1x.
–Authentication with the rogue timed out.
–Bad user password.
–Authentication challenge failed.
This tattletale method is enabled on the AP itself, detected by the AP, and flagged at the AP via the trap.
Q.I configured the Friendly
A.When the
Q.What should I do when my system is overrun with rogue APs?
A.Some networks might experience large numbers of rogues due to the nature of their neighboring networks or a
–Use IDS > Manage Network Wide Settings to disable all rogue detection and processing from either infrastructure or
–If your network is in a crowded airspace, examine the report IDS > Manage Rogues. This report shows you the RSSI value for the detected rogues. Sorting by RSSI might give you a limit of RSSI values that you could use in IDS > Manage Network Wide Settings as a threshold.
–Use IDS > Manage Rogues to delete the rogues that are no longer an issue (for example, from a temporary storm or isolated occurrence) to free up space in the WLSE.
–For an explanation of the fault, see IDS (Intrusion Detection System) Faults, page
Q.Why is a fault generated regardless of the threshold set for detecting rogue APs with an defined RSSI value under IDS > Manage
For example, the threshold is set for detecting a rouge AP with an RSSI value of greater than
A.What happens is as follows:
FAQ and Troubleshooting Guide for the CiscoWorks Wireless LAN Solution Engine
|
| |
|