topic Connected APs showing up as rouge APs and classified as malicious. in Wireless

Connected APs showing up as rouge APs and classified as malicious.

scottsassin — Tue, 25 Jul 2023 20:19:38 GMT

Our 9800-40 WLC has 342 APs connected. We have a combination of 3702, 3802, and 9120 APs. Some of the connected APs are showing up as malicious rouge APs.

Re: Connected APs showing up as rouge APs and classified as malicious.

eglinsky2012 — Tue, 25 Jul 2023 20:48:40 GMT

Are all the APs on the same WLC? I ask because we have some 8540s and 9800-80s all in the same mobility group and the 9800s see the APs on the 8540s as rogue. I haven't gotten around to opening a case for it.

Re: Connected APs showing up as rouge APs and classified as malicious.

scottsassin — Tue, 25 Jul 2023 20:57:35 GMT

Yes, all the rouge APs are on the same controller as the detecting AP.

Re: Connected APs showing up as rouge APs and classified as malicious.

Flavio Miranda — Wed, 26 Jul 2023 00:19:48 GMT

Hi @scottsassin

This is probably a bug. A similar bug is already documented

Cisco Bug: CSCvw81531

Rogue: Cisco Catalyst 9120 AP detects its own BSSID as Rogue in 2.4Ghz channel.

Re: Connected APs showing up as rouge APs and classified as malicious.

scottsassin — Wed, 26 Jul 2023 18:10:51 GMT

This is also happening on the 5Ghz radios.

Do you now if this has detrimental effects on the wireless environment? Should we reclassify all malicious APs as friendly?

Re: Connected APs showing up as rouge APs and classified as malicious.

Rich R — Thu, 27 Jul 2023 11:21:02 GMT

There have been a number of bugs for this - even APs detecting their own radios as rogues (where they have dual radios).

So step number 1 - make sure you're on the latest TAC recommended release as per the link below.

If you still see the problem on latest software then open a TAC case - either they'll point you to an existing bug or open a new one for you.

What version of software are you using?
Have you checked your config with https://cway.cisco.com/wireless-config-analyzer/ using the output of "show tech wireless"?

Re: Connected APs showing up as rouge APs and classified as malicious.

Mark Elsen — Thu, 27 Jul 2023 12:04:37 GMT

- Also consider https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/214749-tac-recommended-ios-xe-builds-for-wirele.html , and or plan an upgrade , if applicable ,