Report for failed login attempts?

GregALSC
New here

Report for failed login attempts?

We have MR33 WAPs with a couple of SSIDs including a "guest" SSID with a single WPA2 password. Our office is located downtown with a bookstore right below us, offering an opportunity for people to sit and attempt to break in to our guest wireless if they were so inclined. I get the weekly summary report that shows some useful information about connections to our wireless environment but it doesn't have anything on failed login attempts. Are there any scheduled reporting options that would summarize failed logins for our SSIDs?

3 REPLIES 3
BrandonS
Kind of a big deal

I don't think you will find such data for WPA2. However, if you use splash logins or Google, Facebook you should see a new option: wireless > login attempts that will show failed and successful logins.

 

 

- Ex community all-star (⌐⊙_⊙)

I have few MR18 which I can monitor through Meraki dashboard. I'm also trying to find how I can get log for failed login attempts. One of the SSID is splash enabled  but I don't see any option "login attempts" under wireless. Is there any other place I can check that?

Korey
Meraki Employee
Meraki Employee

Hi, you can gain this information by exporting Wireless Event Logs to a Syslog Server

https://documentation.meraki.com/zGeneral_Administration/Monitoring_and_Reporting/Syslog_Server_Over...

 

The Even Log for a WPA failure will look similar to this:

"Apr 30 22:26:22 192.168.128.1-1 logger: <134>1 1525141582.164315122 MR33 events type=disassociation radio='1' vap='1' client_mac='20:EE:28:56:AA:25' channel='36' duration='4.019999996' auth_neg_failed='1' is_wpa='1' aid='1687101691'"

 

 

Get notified when there are additional replies to this discussion.
Welcome to the Meraki Community!
To start contributing, simply sign in with your Cisco account. If you don't yet have a Cisco account, you can sign up.
Labels