 |
 |
Has anyone experienced the following before (emails from WCS): -- WCS has detected one or more alarms of category AP and severity Critical for the following items: AP '00:15:c7:2b:5a:90' with protocol '802.11a' on Controller 'xxxx' is contained as a Rogue preventing service. AP '00:15:c7:2b:5a:90' with protocol '802.11b/g' on Controller 'xxx' is contained as a Rogue preventing service. E-mail will be suppressed up to 30 minutes for these alarms. -- WCS has detected a change in one or more alarms of category AP and severity Critical. The new severity of the following items is Clear: AP '00:15:c7:2b:5a:90' with protocol '802.11b/g' on Controller '148.88.249.134' is no longer being contained. Service is restored. E-mail will be suppressed up to 30 minutes for these changes. -- It appears to be containing a couple of our own (Lightweight) APs and then restoring them a few minutes later. Logs on the controllers itself say: Warning: Our AP with Base Radio MAC 00:15:c7:2b:5a:90 is under attack (contained) by another AP on radio type 802.11a This only started happening this morning and seems to be limited to one building (library). Cisco documentation suggests this is due to the rogue AP count exceeding a threshold, although AP's in that building have only detected one rogue AP. Any ideas? Thanks Scott -- Scott Daniels Network Specialist Information System Services Computer Centre Lancaster University LA1 4YW Direct Tel: 01524 510109