Cisco Systems OL-8376-01 manual Cd11IfStationRole from

Chapter 2 Fault Descriptions

IDS (Intrusion Detection System) Faults

Table 2-3	IDS Faults (continued)
Fault Description		Explanation	Related Setting	Recommended Action
Radio Role must be		This fault is raised when a radio is	Radio Mgr > Frame	Review your network to determine
“roleScanner” to support		initially configured for Frame	Monitoring	the action necessary to clear the fault
Frame Monitoring (was		Monitoring (where x is the integer		condition.
x).		value of the SNMP OID		Although this situation might simply
		cd11IfStationRole from the
				be that an administrator no longer
		CISCO-DOT11-IF-MIB), but
				needs to monitor or scan a portion of
		then someone configures the
				their site any longer, it could also be
		radio out of scanning-only mode.
				an intruder who has somehow gained
		As a side effect, this also disables
				console access to a Scanning AP and
		Frame Monitoring.
				is attempting to “blind” IDS services
		When this fault is cleared, the		for a portion of a site.
		following message displays:
		Radio Role is “roleScanner” and
		supports Frame Monitoring.
TKIP Replay is detected		The fault threshold set has been	IDS >	Verify that the fault threshold is set
		exceeded.	Manage IDS Settings	correctly.
		When this fault is cleared, the	> General IDS	If the threshold is set correctly,
			Settings >
		following message displays:		review your network to determine the
			TkipReplayClient
		There is no TKIP Replay		action necessary to clear the fault
		detected.		condition.
TKIP LocalMICFailure is		The fault threshold set has been	IDS >	Verify that the fault threshold is set
detected		exceeded.	Manage IDS Settings	correctly.
		When this fault is cleared, the	> General IDS	If the threshold is set correctly,
			Settings >
		following message displays:		review your network to determine the
			TkipLocalMicFailure
		There is no TKIP		action necessary to clear the fault
		LocalMICFailure detected.	Client	condition.
Unexpected MIC while		This fault is raised against the AP	Not applicable.	See Bad MIC while MFP enabled,
MFP Disabled		that is observed generating the		page 2-16).
		violation.

FAQ and Troubleshooting Guide for the CiscoWorks Wireless LAN Solution Engine

2-22 OL-8376-01