cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
6100
Views
0
Helpful
7
Replies

AP Impersonation of MAC

 

 

This message appears in the log controllers and clients for a certain time are unrelated

 

AP Impersonation of MAC '08:d0:9f:ec:dc:a3' using source MAC '08:d0:9f:ec:dc:a3' is detected by authenticated AP 'ADM_FINANCEIRO' on '802.11b/g' radio and Slot ID '0'.

 

 

Could anyone help me?

7 Replies 7

Sandeep Choudhary
VIP Alumni
VIP Alumni

Could be a bug.

 

What version you running on WLC ?

 

Regards

 

Hello, thanks for answering

 

Version controllers 7.6.130.0

Model 2504

 

AP Model AIR-LAP1142N-T-K9

Its look like a cosmetic bug.

Can you connect client to this AP / does it effect the network connectivity ?

 

There was a bug in earlier version:https://tools.cisco.com/bugsearch/bug/CSCsb90622

If its affecting the network connectivity then you must conatct with TAC.

 

Regards

Dont forget to rate helpful posts

Have you guys come up with any resolution on this issue?

Thanks,

Chris

Chris, please check if your current deployment is being effected with bug CSCup88910.

Hi,

Did you contacted TAC about this issue? I'm running into the same issue with 7.6.130 code with 2600 AP's.

AP Impersonation of MAC '0c:27:24:12:34:56' using source MAC
'0c:27:24:12:34:56' is detected by authenticated AP 'XYX (same as the MAC address)' on
'802.11b/g' radio and Slot ID '0'.

 

Abhishek Abhishek
Cisco Employee
Cisco Employee

It may be a bug -

630937505 - AP impersonation flood of events on WLC 8510-SR14-00512
CSCup88910

Symptom:
AP impersonation alarm are seen in PI, which are found to be false positive

Conditions:
Infrastructure MFP enabled
MFP based AP impersonation detection enabled
Rogue detection enabled.

Workaround:
Disable any of the configurations mentioned in the conditions above.

If it is due to configuration mismatch in AP, try to disable and enable Infra MFP configuration in all the controllers.

Further Problem Description:
Problem is likely to be due to
- malformed beacons coming out occasionally from the AP radio or
- incorrect MFP configuration in one or more AP
The output of show wps mfp statistics might show ' Infra Missing MFP IE 47 Beacon'

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community: