topic Re: MFP Anomaly Detected in Wireless

MFP Anomaly Detected

Alejandro.Angon — Sun, 04 Jul 2021 07:38:50 GMT

Hi,

I have seen this messege log on WLC 5508 running 7.5 code, but I haven´t found any information about it, I will be gratful if any body know what it means

thanks

MFP Anomaly Detected - 3 Not encrypted event(s) found as violated by the radio XX:XX:XX:XX:XX:XX and detected by the dot11 interface at slot 0 of AP XX:XX:XX:XX:XX:XX in 300 seconds when observing Disassoc, Deauth. Client's last source mac XX:XX:XX:XX:XX:XX

MFP Anomaly Detected

Abhishek Abhishek — Wed, 14 Aug 2013 19:22:08 GMT

Hello,

As per your query i can suggest you the following solution-

This error message is seen when frames with incorrect MIC values are detected by MFP enabled LAPs. Refer to Infrastructure Management Frame Protection (MFP) with WLC and LAP Configuration Example for more information on MFP. Complete one of these four steps:

Check and remove any rogue or invalid APs or clients in your network, which generate invalid frames.
Disable the Infrastructure MFP, if MFP is not enabled on other members of the Mobility group as LAPs can hear management frames from LAPs of other WLCs in the group that do not have MFP enabled. Refer to Wireless LAN Controller (WLC) Mobility Groups FAQ for more information on Mobility Group.
The fix for this error message is available in the WLC releases 4.2.112.0 and 5.0.148.2. Upgrade the WLCs to either of these releases.
As a last option, try to reload the LAP that generates this error message.

Hope this will help you.

MFP Anomaly Detected

Joseph Rizzo — Fri, 15 Nov 2013 14:14:28 GMT

Upgrade from 7.5 to 4 or 5 level code ? I am also receiving these errors, I check my rogues every morning. Also, since upgraded to 7.5, I see in unreasonable amount of rogues I have never seen before. Something is wrong with the code. I also get xomplainrts that clients randomly hang since 7.5.

08:01:47 2013

MFP Anomaly Detected - 1 Not encrypted event(s) found as violated by the radio xxxxx and detected by the dot11 interface at slot 0 of AP xxxxxx in 300 seconds when observing . Client's last source mac xxxxxx

Re: MFP Anomaly Detected

Christian S. — Fri, 10 Jan 2014 12:14:28 GMT

Same here. Upgraded from 7.4 to 7.6 (because of support for 3700 APs) and now I get "flooded" with this messages 24/7. I already disabled Infrastructure MFP and also set MFP from optional to disabled on all of my WLANs but the problem still persists. There seems to be something wrong within the code...

Re: MFP Anomaly Detected

Scott Fella — Fri, 10 Jan 2014 13:31:38 GMT

I also see that message and I'm running v7.6. I have MFP disabled and still seeing errors from clients in that WLAN.

Have you experienced client, mainly Apple devices loose layer2/3 connectivity but still associated and in the RUN state? George and I have been testing this and we have seen it on the 3600's and the 3700's? If so, keep us posted.

Sent from Cisco Technical Support iPhone App

Re: MFP Anomaly Detected

Christian S. — Fri, 10 Jan 2014 17:53:33 GMT

Well Scott,

I only replaced one (the one in my area) of our 1260's at the moment to be sure everything runs fine with the new APs, so I only have about 20 clients (some Android, iOS, many Win7) connecte to the 3700 at the moment and nearly all of them run fine. Only one iPhone 5c which is connected to our guest WLAN, web-authenticated and in RUN state has to repeat the web-auth nearly every time it awakes. I tried with another iPhone 4 and a Galaxy S4 and none of them had any troubles. I even went home with them and the next morning they could browse the web without the need for repeating web-auth. All of these devices are associated and in RUN state, but this particular 5c always has to repeat the web-auth... I'm not sure if this has to do something with 7.6 or the 3700, but since you asked. BTW, my global idle-timeout is set to 24h, idle-timeout at WLANs advanced settings is disabled and eap-bcast-key-interval is also 24h, so this can't be the problem.

Additionally I experience loose of L2 connectivity with my own notebook with Intel 7260AC when connected at 11ac, but this seems to be a problem of this card and it's drivers as far as I found out with google... The Galaxy S4 has a stable connection to the 3700 at 11ac.

But this MFP thing is really annoying at the moment and the solution "try to reload the LAP" won't work at all - I'd have to reload all of them (but even tried one, without success)...

Regards,

Christian

Re: MFP Anomaly Detected

Joseph Rizzo — Wed, 15 Jan 2014 17:21:40 GMT

I have upgraded to 7.6.100 on my 5508 and 2504's. The rogue detection is working much better and I am not getting the MFP errors anymore, I have 1250, 1040 and 1140 LWAP's. Not sure if clients continue to hang and get discontinected,but its been about a week, so no news is good news.

MFP Anomaly Detected

maerz-helpdesk — Mon, 20 Jan 2014 10:19:51 GMT

Hello,

this weekend we updated the WLC from our customer to 7.6.100 and also get messages from WCS with MFP Anomaly detection.

The Customer will disable MFP under the WLAN configuration.

I hope this will help and stop these messages.

The global MFP Protection was disabled.

Re: MFP Anomaly Detected

Scott Fella — Mon, 20 Jan 2014 14:31:17 GMT

Christian,

George and I are working with the BU on some issue with loosing layer 2 and v7.6. I have seen issue with my iPhone, iPad and some windows machines but a MacBook Air has no issues. I would open a TAC case so maybe they can start logging something.

George has some MacBooks on the 3700 that also loose layer 2. I'm currently testing on the 3600's bit will test on the 3700 this week.

Sent from Cisco Technical Support iPhone App

Re: MFP Anomaly Detected

Scott Fella — Mon, 20 Jan 2014 14:31:53 GMT

I get those messages still and MFP is disabled on my WLAN's.

Sent from Cisco Technical Support iPhone App

MFP Anomaly Detected

Saravanan Lakshmanan — Tue, 21 Jan 2014 22:31:23 GMT

these're the respective defects filed for the mentioned issues.

CSCum49200 Mac wireless clients in RUN state sometimes unable to ping gateway

CSCum62305 Traffic stops for iphone/mac OS in 7.6 in 3600/3700

MFP Anomaly Detected

Scott Fella — Tue, 21 Jan 2014 23:16:23 GMT

Thanks for the update... George and I have been working with a few guy's on your end with the issues we were seeing.

Thanks,

Scott

Help out other by using the rating system and marking answered questions as "Answered"

MFP Anomaly Detected

Rasika Nayanajith — Wed, 22 Jan 2014 02:21:16 GMT

Hi Saravanan,

Does this first bug is internal, cannot see the detail due to no priviledes ?

Regards

Rasika

MFP Anomaly Detected

Saravanan Lakshmanan — Wed, 22 Jan 2014 03:50:24 GMT

Yes, it was but I made it external, will take 24hrs or so to be external visible. Anyway, both bugs addresses the same issue.

MFP Anomaly Detected

Rasika Nayanajith — Wed, 22 Jan 2014 03:59:20 GMT

Thanks for the update Saravanan

MFP Anomaly Detected

George Stefanick — Fri, 24 Jan 2014 04:51:19 GMT

Glad to see that you guys could reproduce it ..

__________________________________________________________________________________________
"Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin
__________________________________________________________________________________________
‎"I'm in a serious relationship with my Wi-Fi. You could say we have a connection."

Re: MFP Anomaly Detected

Scott Fella — Fri, 24 Jan 2014 13:45:53 GMT

George,

I think we need to follow up with them just to see if they have another ticket created from our testing. I sent them my config so they can test as close to my environment as possible.

Sent from Cisco Technical Support iPhone App

MFP Anomaly Detected

Saravanan Lakshmanan — Fri, 24 Jan 2014 20:29:22 GMT

#Appreciate you guys on bringing in hot issues.

#For issue recreation, the credit goes to an BU escalation.

MFP Anomaly Detected

Christian S. — Fri, 24 Jan 2014 21:04:57 GMT

Hi Scott,

I installed many of the 3702 this week and a lot of our users are using Apple products so they should complain if something doesn't work anymore as it did before. I'll keep you updated, but as Saravanan stated that Cisco is already working on this I'd think that we would also run into these effects...

BTW, MFP is still flooding the logs...

regards,

Christian

MFP Anomaly Detected

Scott Fella — Sat, 25 Jan 2014 13:38:34 GMT

George and I have been working with the BU on issues with v7.6 and I do see issues mainly with Apple, but also with a few Windows machines. MFP logs..... well yes I see those to and just tend to ignore them as most likely an upgrade would or might fix that. Give it some time for users to really complain... I have seen clients bring us in after a few months, because they find out that users are finally complaining that they have to reboot or reset their wireless every so often. I use my iphone a lot and I notice it right away and typically have to just disable my wireless and use cellular. Apple TV's don't seem to have issues, but that's what I have seen so far.

Thanks,

Scott

Help out other by using the rating system and marking answered questions as "Answered"