Association errors

[Alex123]

Hi all,

I'm having some issues with client association errors on our dash for our new network:

auth_mode='wpa3-psk' 11k='1' 11v='1' reason='reserved' radio='2' vap='4' channel='85' rssi='46'

Seems to occur on an initial connection and sometimes when roaming. The issue only occurs on 6 Ghz - If we disable 6 Ghz on the client and fall back to 5 Ghz, there is no error.  Disconnecting/reconnecting to the network triggers the error.

Looking at wireshark, there doesn't appear to be anything out of the norm (4 Packets Authentication, 2 Packets association, then 4 packets for handshake):

Authentication, SN=356, FN=0, Flags =.
Authentication, SN=396, FN=0, Flags=
Authentication, SN=357, FN=0, Flags=
Authentication, SN=397, FN=0, Flags =.
Association Request, SN=358, FN=0, Flags=
Association Response, SN=0, FN=0, Flags=
Key (Message 1 of 4)
Key (Message 2 of 4)
Key (Message 3 of 4)
Key (Message 4 of 4)

<DHCP stuff>

From a performance perspective, the error isn't noticeable on the client. There is also nothing of note in the WLAN report.

We're running MR 30.7.1 /  CW9166I APs / WPA3-SAE / Intel AX211 (also had same issue on Netgear A8000)

Any ideas?

[PhilipDAth]

WPA3 is difficult to get going, full stop.  This is because of client side issues.  And now throw 6Ghz into the mix - it is note really suitable for production roll out yet.

It is nearly always buggy client side drivers.  Start by driving to update the WiFi drivers on whatever the device is.  Don't be surprised if it takes another couple of years before you get drivers that work reliably.

[VivekT]

Hi ,

Are you using this mode of wpa3 ? 

PSK (WPA3-SAE Transition Mode)

[macnerd]

hi, our Cisco 9164 and 9162 are having the same exact error

our meraki dashboard states that “our Intel ax211” clients are experiencing “failure to associate”

we tried using 5GHz only with wpa3-sae, no issue

but when we only use 6Ghz only with wpa3-sae, the issue occurs

the behaviour is the same with @Alex123 the error occurs when users 1st power on their laptop and did a 1st time connect with our ap

and it will occur also when our clients are roaming 

[Alex123]

We are running WPA3 only (no transition mode)

[VivekT]

Can you please try PSK (WPA3-SAE Transition Mode)? We were having similar issue with Meraki Mr57. Post switching from wpa3 only to Transition Mode , now the connectivity is more stable with 6Ghz.

[macnerd]

hi @VivekT 

according to meraki documentation, if we need to use 6Ghz, we can't use wpa3 transition mode

we have tried also, it can't connect

for wpa3 personal, our option is only pure wpa3-sae

we can't go wpa3 enterprise either

[VivekT]

This is what I can see on our dashboard :

When WPA3 is selected, 802.11w is automatically set to required. If any APs broadcasting the SSID do not support WPA3, they will default to WPA2 authentication instead.

WPA3 only : This options comes when we use radius authentication.. The below should be get enabled automatically

802.11w

• Enabled (allow unsupported clients)
• Required (reject unsupported clients)
• Disabled (never use)

If we use PSK .. then we should see WPA3-SAE Transition Mode.802.11w is automatically required

I have MR57 , it works well without any issue.

[Alex123]

Hi VivekT,

When trying to use WPA3 transition mode on 6ghz, I get the error message below:

This SSID will not broadcast on the 6 GHz band. Use WPA3 to enable this band.

Meraki support have recommended to move to the latest stable candidate firmware. I'll report back in a couple of days when I am able to upgrade/test.