Cisco Systems OL-8376-01 manual Floodcount, Framecount,Intervalwind, Owsize

Chapter 2 Fault Descriptions

IDS (Intrusion Detection System) Faults

Table 2-3		IDS Faults (continued)
	Fault Description		Explanation	Related Setting	Recommended Action
	Client authentication error		The fault threshold set for the	IDS >	Verify that the fault threshold is set
	rate is Degraded number		degraded state has been exceeded.	Manage IDS Settings	correctly.
	per minute		When this fault is cleared, the	> IDS-802.11x >	If the threshold is set correctly,
				Authentication Error
			following message displays:		review your network to determine the
				Rate
			Client association error rate is		action necessary to clear the fault
			OK.		condition.
	Client authentication error		The fault threshold set for the
	rate is Overloaded number		overloaded state has been
	per minute		exceeded.
			When this fault is cleared, the
			following message displays:
			Client association error rate is
			OK.
	Client TKIP		A wireless client has detected a	IDS >	Occasionally MIC failures can occur
	RemoteMICFailure is		MIC failure. The MIB value that	Manage IDS Settings	during key rotation. To diagnose the
	detected		is polled is	> General IDS	problem, you should:
			cDot11WidsTkipRemoteMicFail	Settings >	• Check the IOS version.
			ures.	TkipRemoteMicFailu
					• Enable 802.1x logs on the AP.
			When this fault is cleared, the	reClient
					• Perform an SNMP walk of
			following message displays:
			There is no TKIP		cDot11WidsProtectFailClientTa
			RemoteMICFailure detected.		ble to determine which clients
					are reporting the TKIP MIC
					failure. If just one client is
					reporting the failure, it could be
					a client issue
	EAPOL FLOOD is		The fault threshold has been	IDS >	Verify that the fault threshold is set
	detected (Flood count:		exceeded.	Manage IDS Settings	correctly.
	floodcount)		When this fault is cleared, the	> General IDS	If the threshold is set correctly,
				Settings > EAPOL
			following message displays:		review your network to determine the
				Detection
			There is no EAPOL Flood		action necessary to clear the fault
			detected.		condition
	Excessive Action Frames		The fault thresholds been	IDS > Manage IDS	Verify that the fault threshold is set
	in Channel: channel		exceeded.	Settings > General	correctly.
	[Frames:		When this fault is cleared, the	IDS Settings >	If the threshold is set correctly,
	framecount,Interval:wind			Excessive
			following message displays:		review your network to determine the
	owsize]			Management Frame
			Excessive Action Frames not		action necessary to clear the fault
				Detection
			present in Channel.		condition.
	Excessive Action Frames		The fault thresholds been	IDS > Manage IDS	Verify that the fault threshold is set
	from STA: station		exceeded.	Settings > General	correctly.
	[Frames:		When this fault is cleared, the	IDS Settings >	If the threshold is set correctly,
	framecount,Interval:wind			Excessive
			following message displays:		review your network to determine the
	owsize]			Management Frame
			Excessive Action Frames from		action necessary to clear the fault
				Detection
			STA: station not present		condition.
			FAQ and Troubleshooting Guide for the CiscoWorks Wireless LAN Solution Engine
	OL-8376-01					2-17