To Enable Monitor Radio in CW9166 AP

[madhurimuppalla]

Hi,

How to enable the Monitor Radio on the C9800-CL Wireless LAN Controller CLI or GUI, or the CW9166 Access Point CLI?

[JPavonM]

The monitoring radio is alway up and running collecting statistics.

But if you pretend to use it for monitoring wIPS alerts and perform Rogue management functions ONLY, you need to turn all the AP into Monitor mode.

[madhurimuppalla]

Where can we verify whether the monitor radio is currently enabled on the C9800-CL Wireless LAN Controller or the CW9166 Access Point? and what steps are necessary to operate the Monitor Radio effectively?

[Rich R]

The scanning radio is used for CleanAir Pro and Spectrum Analysis which you can check on the WLC and Catalyst Centre.

[madhurimuppalla]

@Rich R @JPavonM 

According to the Cisco 9166 Access point Deployment guide, we understand  that the scanning radio will check for rogue and wireless intrusion prevention system (WIPS) detection, packet capture, spectrum analysis, interference detection, Clean Air Pro, and other features.
Are there any CLI commands available to verify whether such functionalities are activated or not on the C9800 WLC or CW9166AP?

How can I activate them using the GUI or CLI commands if they aren't activated?

[JPavonM]

This is how to enable such features under Configuration>Profiles>AP Join>Security

And to check whether this is enabled or not on a especific AP, look for any rogue device (any neighbour AP) in the GUI under Monitoring>Wireless>Rogues (then click on one of them to get the AP that detects it and details):

Or through CLI:

sh wireless wps rogue ap summary
sh awips alarm detailed (and filter by your AP's radio MAC address)

 NOTE: aWIPS alerts are not seen in WLC GUI but on DNA-C.

[madhurimuppalla]

Hi @JPavonM @Rich R 
1. I’m currently observing multiple rogue AP entries under the Monitor > Rogues section in the C9800-CL GUI (running IOS-XE 17.15.1), many of which are marked as “Unclassified”.
-> Could you please clarify the operational significance of the rogue information within the controller?
-> Additionally, are there any automated actions taken by the WLC or AP based on this detection?
2. In case of a failure of the triband monitor radio antenna on a CW9166 AP (covering 2.4GHz, 5GHz, and 6GHz scanning).
-> How is this failure detected and reported? Is it identified by the AP or the controller, and is it visible through the GUI, CLI, or SNMP?

[JPavonM]

1. Cisco WLC classify all neighbour wirelewss networks as rogue Unclassified, so no risk at all with them, and no actions are taken agains any external networks unless especifically configured by the admin, what is not recommended.

2. The 3rd radio in the AP allows to scan and apply countermeasures that you can configure under the WIPS section, but if it fails, the AP will continue scanning for neighbour networks with the radio interfaces used to manage rtraffic to/from clients if this is configured in the ap profile, like legacy APs like AP3800 do (unless Cisco would have modified the software on these APs with a dedicated monitor antenna to not to do that)