AP Impersonation setting causing APs to showing up as a rogue threat l

[john-w-sullivan]

AP Impersonation setting causing APs to showing up as a rogue threat level. Is it necessary to have it enabled on an AP? We do not use lightweight APs. If it is disabled to get rid of the rogue threat levels in DNAC, what effect will it have? I can't find enough information to make a determination.

[Mark Elsen · Accepted solution]

  - @john-w-sullivan   Actually there is no other option then to disable these checks in DNAC , because if you are only using
                                  standalone access points, then DNAC has no reference about which access points are legitimate.

  M.

[john-w-sullivan]

When you say stand alone APs, are you talking about the lightweight APs? We are an enterprise network (no lightweights) - will DNAC have a reference with our APs? I want to make sure I understand what you stated.

[Mark Elsen]

    - @john-w-sullivan    Standalone APs are the reverse of  lightweight APs which are steered by a controller.
                                     Using   lightweight APs  together with a controller is a preferred solution for 
                                     enterprise wireless networking. Besides centralized management of access points
                                     the controller steers channel allocation (DCA)  and power control (TPC) on the access points
                                     for optimal coverage (e.g.)
                                            (DNAC can not be used for managing standalone access points neither, it
                                             is developed for controller based wireless deployments)

  M.

[john-w-sullivan]

I have a background with Aruba and still trying to wrap my head around the Cisco terminology. Very simply, if I disable AP Impersonation, I know it will get rid of the rogue warnings in DNAC reports, but what other effects will it have on the enterprise network? I don't like the idea that an authorized AP in my network is being detected as a rogue.

[Mark Elsen]

  - @john-w-sullivan  Because DNAC does not support standalone AP's ,  it will flag any standalone-AP as a roque, that being harmless

  M.

[john-w-sullivan]

Thanks, had to research some terms.  We do not have any stand-alone APs, all are managed by a controller so we must have Lightweight APs. But yet we have APs showing up as rogues with the AP Impersonation. and AP Impersonation is enabled.

[Mark Elsen]

  - @john-w-sullivan   In any company environment you will usually have lot's of unofficial access points being seen by
                                  the official wireless environment, due to smartphones , Personal Wi-Fi routers or hotspots
                                  and other similar  devices at the user's end.
                                  Usually they will be harmless. I think for instance that when examining a rogue AP being reported , you can
                                  for instance classify it as Friendly in DNAC (if being judged as not harmless)

  M.

[Rich R]

@john-w-sullivan what version of software is your WLC running?
There have been a number of bugs with APs incorrectly detecting their own and neighbour radios as rogues so you need to make sure you're running up to date software with fixes for those (see TAC Recommended link below).  Example:
https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvx80829
Also take note of https://bst.cloudapps.cisco.com/bugsearch/bug/CSCwj81093 which says that impersonation detection only works correctly with Aironet-IE enabled (disabled by default on 9800) - covered in the Best Practices guide (link below).
That bug is actually an enhancement request to make impersonation detection work properly without Aironet-IE.

[john-w-sullivan]

The APs are on a Cisco Catalyst 9800-40 Wireless Controller with version 17.9.5

[Rich R]

> version 17.9.5
Which is now rather out of date and approaching end of life.
Therefore pay close attention to the TAC recommended code versions (link below) and aim to upgrade your WLCs regularly to keep them on fully supported versions of code.

Did you check the Aironet-IE settings?