AP Impersonation

[Andreas_Seybold-Epting]

Hi at all,

I have some Controller (4404) in our Company. I use the WCS with Version 7.0.164.0 and all Controllers have Version 7.0.98.0.

Now my Problem.

I get from the WCS some Messages with "AP Impersonation (than a mac)".

The Message Text is: "AP Impersonation of MAC '00:11:5c:6d:a5:a0' using source MAC  '00:11:5c:6d:a5:a0' is detected by authenticated AP 'g7-2ug-ap-03'  on '802.11b/g' radio and Slot ID '0'. - Controller Name: WLC-01"

When i search this MAC from the Message in the WCS (00:11:5c:6d:a5:a0) then i get the same AP how has found this Impersonation.

The AP Model is a 1230.

Can Anybody this explain ?

Thans for your help.

regards

Andreas

[Surendra BG]

Hi Andreas,

This error msg means that some rogue device is spoofing the mac-address 00:11:5c:6d:a5:a0.  However, The mac-address of device that's detecting the error, this looks more like the AP itself is detecting and impersonating itself... Please makke sure if we are able to conenct any clients to that AP and check the connectivity.

Also make sure that if we really have someone who is spoofing.. If not feel free to open up a case wit hCisco TAC. We will help you!!

lemme know if this answered your question..

Regards
Surendra
====
Please dont forget to rate the posts which answered your question and mark it as answered or was helpfull

[Andreas_Seybold-Epting]

Hi Surendra,

thanks for this Answer.

Only this AP found itself. I have some AP with the same Problem.

On the AP are some Clients are Connected without Problems.

Regards

Andreas

[Surendra BG]

Hi Andreas,

Ok!! if we are not facing any issues pointing to the client connectivity or something, then no issues.. if you face any.. then TAC is the best resource..

Few months even my LAB devoice faced the same issue which degraded my LAB, but it was on 4.2.207 and i have not seen the same on 7.0.98 , i guess there only few customer on this world who are facing this issue on 7.0 release!!

lemme know if this answered your question..

Regards
Surendra
====
Please dont forget to rate the posts which answered your question and mark it as answered or was helpfull

[nouman_nabi]

Hi Surendra,

I am facing same issue  how can I resolve it  ?

i am using same Version 7.0.98.0

Thanks

Nomi

[Leo Laohoo]

Hi Nomi,

Reload the AP in question.  Mostly fixes itself.

[abwahid]

Hi,

please check the below post for the same query.

https://supportforums.cisco.com/discussion/10145656/ap-impersonation-alarms-wcs-4183