AP fault tolerance + rogue detection + AAA override / SGT
- Services & wireless
- Advanced
- 12 min
- 3 steps
- Cisco IOS-XE-style
Three more 300-430 ENWLSI surfaces, all config + show. AP fault tolerance (Slice T): per-apProfile primary/secondary/tertiary controllers + image predownload. Rogue AP detection (Slice U): controller carries a static rogue-list with classification (malicious / friendly / unclassified), RSSI, channel; show wireless wps rogue ap summary reports it. AAA override + TrustSec SGT (Slice V): policy profile gains aaaOverride: boolean and sgt: number | null; show wireless profile policy detail NAME reveals the full per-profile config.
Open this lab in your browser →
Free · no install · no account
Scenario
Three independent operator-visible knobs. They land together because they're all "config + show + verification" — no new datapath, no new wire encap, just IR + render. Real Cisco APs configure up to three controllers in priority order (capwap ap primary-base, secondary-base, tertiary-base). On primary failure the AP retries the secondary, then tertiary. Plus capwap ap predownload for fetching the next image before reload to reduce post-reload downtime. The simulator stores the strings (controller name + IP) verbatim on each apProfile. show ap config fault-tolerance walks them. Cisco WLCs run aWIPS-style monitoring: APs scan off-channel for foreign BSSIDs and report them. The controller classifies each as malicious | friendly | unclassified. The simulator stores the rogue list as a static topology fact (no frame-level scanning — that needs a discrete-event radio model) plus a show command. policyProfile.aaaOverride: boolean toggles whether the profile honours RADIUS-supplied attributes (Tunnel-Private-Group-Id for VLAN, Cisco-AVPair for ACL, Cisco-SGT for security group). policyProfile.sgt is the static SGT (0..65535) stamped on traffic from this WLAN. show wireless profile policy detail NAME dumps the full config.
Topology
1 × wireless controller · Cisco IOS-XE-style
WLC1— wireless controller
What you will do
On WLC1, run
show ap config fault-tolerance. The branch-ap profile should report all three controllers configured + image predownload enabled.Run
show wireless wps rogue ap summary. 2 rogues — one malicious (evil-twin), one friendly (neighbor-net).Run
show wireless profile policy detail CORP-POL. AAA override should be enabled, SGT should be 100.
Open this lab in your browser →
More labs on this topic
- Configure a DHCP serverBeginner · 12 min
- WLAN — broadcast a basic SSIDBeginner · 10 min
- HSRP: configure first-hop redundancyIntermediate · 12 min
- NAT: PAT (overload) for an inside LANIntermediate · 14 min
- HSRP — interface tracking with priority decrementIntermediate · 12 min
- VRF-Lite — two customers on one routerIntermediate · 12 min
This lab in other languages
AP-Fehlertoleranz + Rogue-Erkennung + AAA-Override / SGTTolerancia a fallas de AP + detección de delincuentes + anulación de AAA / SGTTolerância a falhas de AP + detecção de invasores + substituição de AAA / SGTTolérance aux pannes AP + détection des escrocs + remplacement AAA / SGTएपी दोष सहिष्णुता + दुष्ट का पता लगाना + एएए ओवरराइड / एसजीटीAP容错+恶意检测+AAA覆盖/SGTTolleranza agli errori AP + rilevamento rogue + override AAA/SGTAP フォールト トレランス + 不正検出 + AAA オーバーライド / SGTAP 내결함성 + 불량 감지 + AAA 재정의 / SGTОтказоустойчивость точки доступа + обнаружение несанкционированных действий + переопределение AAA / SGTAP hata toleransı + hileli algılama + AAA geçersiz kılma / SGTKhả năng chịu lỗi AP + phát hiện giả mạo + ghi đè AAA / SGT