Connected APs showing up as rouge APs and classified as malicious.

[scottsassin]

Our 9800-40 WLC has 342 APs connected. We have a combination of 3702, 3802, and 9120 APs. Some of the connected APs are showing up as malicious rouge APs. 

[eglinsky2012]

Are all the APs on the same WLC? I ask because we have some 8540s and 9800-80s all in the same mobility group and the 9800s see the APs on the 8540s as rogue. I haven't gotten around to opening a case for it.

[scottsassin]

Yes, all the rouge APs are on the same controller as the detecting AP. 

[Flavio Miranda]

Hi @scottsassin 

 This is probably a bug. A similar bug is already documented

Cisco Bug: CSCvw81531

---

Rogue: Cisco Catalyst 9120 AP detects its own BSSID as Rogue in 2.4Ghz channel.

---

[scottsassin]

This is also happening on the 5Ghz radios. 

Do you now if this has detrimental effects on the wireless environment? Should we reclassify all malicious APs as friendly? 

[Rich R]

There have been a number of bugs for this - even APs detecting their own radios as rogues (where they have dual radios).

So step number 1 - make sure you're on the latest TAC recommended release as per the link below. 

If you still see the problem on latest software then open a TAC case - either they'll point you to an existing bug or open a new one for you. 

What version of software are you using?
Have you checked your config with https://cway.cisco.com/wireless-config-analyzer/ using the output of "show tech wireless"?

[marce1000]

  - Also consider https://www.cisco.com/c/en/us/support/docs/wireless/catalyst-9800-series-wireless-controllers/214749-tac-recommended-ios-xe-builds-for-wirele.html  , and or plan an upgrade , if applicable , 

 M.