Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.1.x

PDF

Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.1.x

Wireless Service Assurance (WSA) rogue events

Updated: April 10, 2026

Want to summarize with AI?

Log in

Explains wireless service assurance rogue events, including event monitoring and configuration steps, to enhance visibility and proactive management of rogue devices in the wireless network.

Wireless Service Assurance (WSA) rogue events are telemetry notifications that replicate the information of corresponding SNMP traps. Support is available in Release 16.12.x, where x denotes a release version.

  • You receive details such as the MAC address of the rogue AP.

  • You receive information about the managed AP and the radio that detected the rogue AP with the strongest RSSI.

  • You receive event-specific data, such as SSID; channel for potential honeypot events; and MAC address of the impersonating AP for impersonation events.

WSA Rogue Events: Details and Support

For all exported events, these details are provided to the wireless service assurance (WSA) infrastructure:

  • MAC address of the rogue AP

  • Details of the managed AP and the radio that detected the rogue AP with the strongest RSSI

  • Event-specific data such as SSID; channel for potential honeypot events; and MAC address of the impersonating AP for impersonation events.

You can scale the WSA rogue events feature up to four times the maximum number of supported access points (APs). You can also scale it to one-half of the maximum number of supported clients.

The WSA rogue events feature is supported on Cisco Catalyst Center and other third-party infrastructure.

Wireless service assurance rogue events

Configure your wireless device to send service assurance rogue event data to the event queue.

Before you begin

To configure wireless service assurance for rogue events, complete these steps.

Procedure

1.

Enter global configuration mode.

Example:

Device# configure terminal
2.

Enable wireless service assurance.

Example:

Device# network-assurance enable
3.

Enable wireless service assurance for rogue devices.

Example:

Device# wireless wps rogue network-assurance enable

This ensures that the wireless service assurance (WSA) rogue events are sent to the event queue.

Your device sends wireless service assurance rogue events to the event queue for enhanced monitoring.

Monitor wireless service assurance rogue events

View wireless service assurance (WSA) rogue event statistics and details.

Before you begin

Use these steps to monitor wireless service assurance rogue events.

Procedure

1.

show wireless wps rogue stats

Example:

Device# show wireless wps rogue stats
            WSA Events
            Total WSA Events Triggered          : 9
            ROGUE_POTENTIAL_HONEYPOT_DETECTED   : 2
            ROGUE_POTENTIAL_HONEYPOT_CLEARED    : 3
            ROGUE_AP_IMPERSONATION_DETECTED     : 4
            Total WSA Events Enqueued           : 6
            ROGUE_POTENTIAL_HONEYPOT_DETECTED   : 1
            ROGUE_POTENTIAL_HONEYPOT_CLEARED    : 2
            ROGUE_AP_IMPERSONATION_DETECTED     : 3

In this example, nine events occurred, but only six events were enqueued. Three events occurred before you enabled the WSA rogue feature.
2.

show wireless wps rogue stats internal

show wireless wps rogue ap detailed rogue-ap-mac-addr

These commands display information about WSA events in the event history.

You can track WSA rogue event activity, investigate event history, and verify system responsiveness to rogue threats.