Odd AP Authorization issue

[Ryan Curry]

About 2 weeks ago I installed a 2125 controller in one of our remote sites that had 4 LWAPP aps.  Prior to the controller install, the APs were tunneling across the WAN to our main campus.  Once the controller was installed, I started to get the following critical alarm in WCS and I can't figure out what I need to do to take care of it:

Failed to authorize AP '<MAC>' with certificate type  'Unknown' on controller '<Remote Site's Controller>'. 'AP Authorization entry does not  exist in the Controllers AP Authorization List.'

From what I've seen, the reported AP is not a Cisco radio MAC and the existing APs are running fine.  Aside from taking my Air Magnet laptop over there and hunting down (and turning off) the device I'm at a loss on what action I can take.  Does anyone have a suggestions on this scenario?

Thanks all!

[Stephen Rodriguez]

Ryan,

  You could try to chase the mac address/ apr entry down and find the port it's connected to.

[dmantill]

yes seems to be an attack if  the ip address does not belong to a cisco ap. Is it happening only in one remote site?  Btw do the trace on the wired site at first by checking the mac address table  or arp table   Regards   

Posted from my mobile device.

[Ryan Curry]

Well, I'm an idiot -- based on the suggestions here, I looked outside of the local network and back to my core and found that MAC address.  After tracing it down and getting the IP from the core's ARP table I found the crux of the problem - it's my location appliance.  The same location appliance that I have an open TAC case with because it's not communicating with this WLC (LOL, ya think the two are realated???).  I think my issue has to due with not having the WLC configured to accept SSC.

Ugh, somedays you're the pidgeon, somedays you're the statue ....

Thanks for the help guys.

EDIT - It's definately a SSC issue, will take care of it tonight.