topic Re: AP Impersonation setting causing APs to showing up as a rogue thre in Wireless

AP Impersonation setting causing APs to showing up as a rogue threat l

john-w-sullivan — Wed, 08 Oct 2025 20:04:47 GMT

AP Impersonation setting causing APs to showing up as a rogue threat level. Is it necessary to have it enabled on an AP? We do not use lightweight APs. If it is disabled to get rid of the rogue threat levels in DNAC, what effect will it have? I can't find enough information to make a determination.

Re: AP Impersonation setting causing APs to showing up as a rogue thre

Mark Elsen — Thu, 09 Oct 2025 12:12:46 GMT

- @john-w-sullivan Actually there is no other option then to disable these checks in DNAC , because if you are only using
standalone access points, then DNAC has no reference about which access points are legitimate.

Re: AP Impersonation setting causing APs to showing up as a rogue thre

john-w-sullivan — Thu, 09 Oct 2025 12:44:56 GMT

When you say stand alone APs, are you talking about the lightweight APs? We are an enterprise network (no lightweights) - will DNAC have a reference with our APs? I want to make sure I understand what you stated.

Re: AP Impersonation setting causing APs to showing up as a rogue thre

Mark Elsen — Thu, 09 Oct 2025 12:55:12 GMT

- @john-w-sullivan Standalone APs are the reverse of lightweight APs which are steered by a controller.
Using lightweight APs together with a controller is a preferred solution for
enterprise wireless networking. Besides centralized management of access points
the controller steers channel allocation (DCA) and power control (TPC) on the access points
for optimal coverage (e.g.)
(DNAC can not be used for managing standalone access points neither, it
is developed for controller based wireless deployments)

Re: AP Impersonation setting causing APs to showing up as a rogue thre

john-w-sullivan — Thu, 09 Oct 2025 15:03:48 GMT

I have a background with Aruba and still trying to wrap my head around the Cisco terminology. Very simply, if I disable AP Impersonation, I know it will get rid of the rogue warnings in DNAC reports, but what other effects will it have on the enterprise network? I don't like the idea that an authorized AP in my network is being detected as a rogue.

Re: AP Impersonation setting causing APs to showing up as a rogue thre

Mark Elsen — Thu, 09 Oct 2025 15:36:50 GMT

- @john-w-sullivan Because DNAC does not support standalone AP's , it will flag any standalone-AP as a roque, that being harmless

Re: AP Impersonation setting causing APs to showing up as a rogue thre

john-w-sullivan — Fri, 10 Oct 2025 13:21:43 GMT

Thanks, had to research some terms. We do not have any stand-alone APs, all are managed by a controller so we must have Lightweight APs. But yet we have APs showing up as rogues with the AP Impersonation. and AP Impersonation is enabled.

Re: AP Impersonation setting causing APs to showing up as a rogue thre

Mark Elsen — Fri, 10 Oct 2025 15:16:09 GMT

- @john-w-sullivan In any company environment you will usually have lot's of unofficial access points being seen by
the official wireless environment, due to smartphones , Personal Wi-Fi routers or hotspots
and other similar devices at the user's end.
Usually they will be harmless. I think for instance that when examining a rogue AP being reported , you can
for instance classify it as Friendly in DNAC (if being judged as not harmless)

Re: AP Impersonation setting causing APs to showing up as a rogue thre

Rich R — Sun, 12 Oct 2025 17:14:52 GMT

@john-w-sullivan what version of software is your WLC running?
There have been a number of bugs with APs incorrectly detecting their own and neighbour radios as rogues so you need to make sure you're running up to date software with fixes for those (see TAC Recommended link below). Example:
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvx80829
Also take note of https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwj81093 which says that impersonation detection only works correctly with Aironet-IE enabled (disabled by default on 9800) - covered in the Best Practices guide (link below).
That bug is actually an enhancement request to make impersonation detection work properly without Aironet-IE.

Re: AP Impersonation setting causing APs to showing up as a rogue thre

john-w-sullivan — Fri, 24 Oct 2025 12:05:19 GMT

The APs are on a Cisco Catalyst 9800-40 Wireless Controller with version 17.9.5

Re: AP Impersonation setting causing APs to showing up as a rogue thre

Rich R — Fri, 24 Oct 2025 12:12:19 GMT

> version 17.9.5
Which is now rather out of date and approaching end of life.
Therefore pay close attention to the TAC recommended code versions (link below) and aim to upgrade your WLCs regularly to keep them on fully supported versions of code.

Did you check the Aironet-IE settings?