topic Re: WPA3 errors without WPA3 configured in Wireless

WPA3 errors without WPA3 configured

Todd S — Tue, 07 Feb 2023 21:26:18 GMT

Have an SSID that is configured for WPA2-Enterprise using Radius/802.1x-PEAP. 802.11w is set to required. SSID is running in NAT mode.

At times I am seeing errors like the following:

Client made an 802.1X authentication request to the RADIUS server, but it did not respond. auth_mode='wpa3-802.1x' radius_proto='ipv4' radius_ip='192.168.xxx.xxx' reason='radius_login_failure' radio='0' vap='3' channel='6' rssi='42'

The client is configured for WPA2. The client was successfully connected and then all the sudden couldn't roam to this AP and the above error was seen in the connection log. Eventually, with no changes to the client or on the dashboard, the client was able to connect.

APs are MR42s and they are running MR 29.4.1

Re: WPA3 errors without WPA3 configured

aleabrahao — Tue, 07 Feb 2023 21:37:55 GMT

Disable 802.11w and all will be fine.

Some legacy devices that do not support 802.11w may not be able to connect to an SSID even if in mixed mode. This may be due to the device improperly handling the advertised information contained within the beacons.

Re: WPA3 errors without WPA3 configured

Todd S — Tue, 07 Feb 2023 21:41:47 GMT

If I wasn't getting hammered with deauthentications from a neighbor then I would disable 802.11w.

Why would 802.11w trigger WPA3 errors?

Re: WPA3 errors without WPA3 configured

aleabrahao — Tue, 07 Feb 2023 21:52:42 GMT

Disable 802.11w and all will be fine.

Re: WPA3 errors without WPA3 configured

Todd S — Tue, 07 Feb 2023 21:54:24 GMT

That the thing, the device does support 802.11w. It was previously connected and was able to connect after the fact eventually.

Re: WPA3 errors without WPA3 configured

aleabrahao — Tue, 07 Feb 2023 22:01:52 GMT

WPA3 Transition Mode
WPA3 SAE has a transition mode (sometimes called mixed mode) created to allow WPA2 clients to co-exist on the same SSID used for WPA3. Although WPA3 needs to have Management Frame Protection (MFP/802.11w) set to Required, the Dashboard can also be set to Enabled, so that the STA which are not compliant with either WPA3 or MFP can still connect seamlessly.

802.11w can be set to Required, however WPA2 clients which do not support MFP will not be able to associate.

Re: WPA3 errors without WPA3 configured

Todd S — Tue, 07 Feb 2023 22:03:08 GMT

WPA3 transition mode is only if you are doing PSK. Isn't available for WPA3-Enterprise.

Re: WPA3 errors without WPA3 configured

aleabrahao — Tue, 07 Feb 2023 22:06:41 GMT

Ok, but it explains the following behaviors that you informed us about, you can open a support case to confirm. 😉

Re: WPA3 errors without WPA3 configured

Rasmus Hoffmann Birkelund — Wed, 08 Feb 2023 05:46:22 GMT

Instead of having the SSID in NAT mode, try putting the device directly on the network, using Bridge Mode.

Re: WPA3 errors without WPA3 configured

o pyrrhon — Mon, 20 Feb 2023 13:41:05 GMT

Thanks man 🙂 you saved my day!!!

Re: WPA3 errors without WPA3 configured

Todd S — Mon, 20 Feb 2023 13:43:30 GMT

Opened a case. This behavior is a known bug.

Re: WPA3 errors without WPA3 configured

CTL1 — Tue, 07 Mar 2023 17:33:44 GMT

Do you have any update from the case? when it will be solved?