Rogue Policy on 9800 for notification deviation

[SpencerCal]

I'm working on getting our standards in place for Rogue AP management on 9800s and I've come across this setting that I'm struggling to understand.

wireless wps rogue client notify-min-deviation 5
wireless wps rogue ap notify-rssi-deviation 5

Description from documentation : Configures the RSSI deviation notification threshold for rogue clients/APs. Valid range for the RSSI threshold in dB is 0 dB to 10 dB.

I saw in a Cisco live slideshow that it was recommended to set this to something around 5, but I don't really understand what I'm setting here. All I know is that it was supposed to be setup to reduce notifications. Can anyone else me out?

[Mark Elsen]

 - Ref : https://www.ciscolive.com/c/dam/r/ciscolive/global-event/docs/2023/pdf/BRKEWN-3004.pdf
               Start reading from Rogue Notification Triggers

 M.

[Consel · Accepted solution]

The "wireless wps rogue client notify-min-deviation" and "wireless wps rogue ap notify-rssi-deviation" settings you mentioned are related to Rogue AP management on Cisco Catalyst 9800 Series Wireless Controllers. Let's break down what these settings do:

1. wireless wps rogue client notify-min-deviation: This setting configures the minimum RSSI (Received Signal Strength Indication) deviation threshold for rogue clients. RSSI is a measure of the power level received by the wireless client's antenna from an access point (AP). Setting a value here means that if the RSSI of a rogue client differs from the expected RSSI by at least this amount, a notification will be generated.

2. wireless wps rogue ap notify-rssi-deviation: This setting configures the RSSI deviation threshold for rogue access points. Similar to the client setting, it determines the minimum difference in RSSI that will trigger a notification for rogue APs.

The recommended value of 5 dB is suggesting that you set the threshold for rogue client and AP notifications to 5 dB. This means that if the measured RSSI of a rogue client or AP deviates from the expected RSSI by 5 dB or more, a notification will be generated.

Setting these thresholds helps to reduce unnecessary notifications by filtering out insignificant RSSI variations that might occur due to environmental factors or normal fluctuations in signal strength. By setting a threshold, you ensure that only significant deviations trigger alerts, thereby reducing noise and false positives in your Rogue AP management system.

In summary, by setting these values to 5 dB, you're essentially telling the system to only notify you when there's a substantial deviation in RSSI, which helps in better managing rogue APs and clients without being overwhelmed by irrelevant notifications.

Lee County Property Appraiser

[jwikiera]

if a Rogue AP / rogue client RSSI changes less than the configured threshold since the last telemetry update, then the change is stored by the wireless controller, but no immediate update is sent via the yang/netconf telemetry (used by Cisco Catalyst Center(DNA Center), PRIME) and to CMX (Cisco proprietary NMSP protocol).