WLC Rogue APs

[anishkmr0071]

hi everyone,

i have an issue, i have list of rogues that are in "unclassified rogue". when i classify any of them to "malicious" and "state: alert". it will go to "malicious rogues". but after sometime again it goes back to "unclassified rogues". can anyone explain or help me figure out this issue.

[patoberli]

I've never seen this, but about how many rogues are we talking here?
And what software are you running on your WLC?
Do you maybe have another server, like Cisco Prime Infrastructure, running and managing the WLC?

[anishkmr0071]

i have added 10-15 rogues to "malicious and state:alert". it's wlc2504 with 8.2.151.0 version. no i don't have any server.

[Scott Fella]

That shouldn’t happen unless the entries disappeared. I typically only use rules that duplicate own SSID also known rogue as no alerting. 

[patoberli]

I also don't know this behavior. If you don't use any containment rules, it's at least just a visual issue and not impacting your wireless.
There were some bugs with rogue APs fixed in 8.2.16x.0, but none that sounds like your issue:
https://www.cisco.com/c/en/us/td/docs/wireless/controller/release/notes/crn82mr6.html
Anyway, I suggest you upgrade for security reasons to 8.2.170.0 and check if the issue goes away.