topic Re: WLC Rogue APs in Wireless

WLC Rogue APs

anishkmr0071 — Mon, 05 Jul 2021 15:45:50 GMT

hi everyone,

i have an issue, i have list of rogues that are in "unclassified rogue". when i classify any of them to "malicious" and "state: alert". it will go to "malicious rogues". but after sometime again it goes back to "unclassified rogues". can anyone explain or help me figure out this issue.

Re: WLC Rogue APs

patoberli — Thu, 21 Jun 2018 11:34:38 GMT

I've never seen this, but about how many rogues are we talking here?
And what software are you running on your WLC?
Do you maybe have another server, like Cisco Prime Infrastructure, running and managing the WLC?

Re: WLC Rogue APs

anishkmr0071 — Thu, 21 Jun 2018 15:44:45 GMT

i have added 10-15 rogues to "malicious and state:alert". it's wlc2504 with 8.2.151.0 version. no i don't have any server.

Re: WLC Rogue APs

Scott Fella — Thu, 21 Jun 2018 15:48:28 GMT

That shouldn’t happen unless the entries disappeared. I typically only use rules that duplicate own SSID also known rogue as no alerting.

Re: WLC Rogue APs

patoberli — Fri, 22 Jun 2018 06:39:08 GMT

I also don't know this behavior. If you don't use any containment rules, it's at least just a visual issue and not impacting your wireless.
There were some bugs with rogue APs fixed in 8.2.16x.0, but none that sounds like your issue:
https://www.cisco.com/c/en/us/td/docs/wireless/controller/release/notes/crn82mr6.html
Anyway, I suggest you upgrade for security reasons to 8.2.170.0 and check if the issue goes away.