Cat9800 aWIPS alarms in DNAC

[KevinR99]

Hi

We have a Cat9800 controller with aWIPs enabled and it is sending alarms to a DNAC appliance.  I am seeing quite a lot of alarms that, if they are real, would suggest we have an inordinate number of Wifi attackers in our office.  The most frequent alarms are

Block Ack flood

Authentication floods

Targeted Deauthentication

Association flood

I really can't believe these are real events.

Has anyone deployed aWIPs on 9800's and seen similar results?

Thanks, Kev.

[Flavio Miranda]

Hi

 I used to play with wIPS and I saw false alarms all the time. To be honest, wIPS is one the most unsuccessful  solution I ever see in my life.

[ammahend]

Do you have multi vendor environment by any chance ? 
it’s some manual work for sure but this might help you.

https://www.cisco.com/c/en/us/td/docs/cloud-systems-management/network-automation-and-management/dna-center-rogue-management-application/2-1-2/quick-start-guide/b_rogue_management_qsg_2_1_2/m_rogue_management_and_awips_workflow.pdf

[Arshad Safrulla]

Below are mostly RF related attacks where mitigation is very limited or not possible. Description for all the possible alerts are listed in the below article.

https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/17-1/config-guide/b_wl_17_11_cg/b_wl_17_11_cg_chapter_010001100.html

I would not agree that the aWIPS is not a successful product. It has it's own use cases, for example if a client is complaining about connectivity issues you can have a look at aWIPS alerts from that AP or the AP's in the vicinity to check whether there is any targeted deauths. Most importantly Rogue detection and containment is also part of aWIPS (Some countries may have legal complications using this feature, take caution) aWIPS will provide you a holistic view of and threat landscape at RF level. With the enterprises moving to complete wireless connectivity, this is one of the must features to have. As @ammahend mentioned there could be lot of false positives as wireless medium itself is not restricted and an attacked with a directional antenna with enough gain could trigger deauth's in your wireless environment may be sitting meters away.