802.11r Fast Transition how to understand that FT works?

[cotequeiroz]

@drut

You use HT20 instead of HE20 for 2.4GHz - why?
Docs says HE is for 'ax' networks

I don’t think 2.4G mt7622 supports HE. To be sure, I just gave it a try and it doesn’t go up.

[_FailSafe]

@cotequeiroz

I don’t think 2.4G mt7622 supports HE

Along with this, it is my understanding that bss_color is a feature included in an HE transmission (within the PHY header). Therefore, I do not believe bss_color has any bearing in 2.4Ghz HT. Does anyone know differently?

[eR2022]

Sounds logical
Bss coloring is wifi 6 feature (AX=HE)

[Lynx]

Mindful that WPA2 PSK roaming is problematic for some of our iOS devices might switching to WPA3 SAE actually help or unlikely?

Otherwise any ideas for things to try to get the iOS devices to behave with roaming?

[zagi-tng]

Using SNAPSHOT

2023 daemon.notice hostapd: phy0-ap1: AP-STA-CONNECTED 42:04:43:03:ed:1f auth_alg=ft

had to install wpad (instead of default wpad-basic-mbedtls ! ) then i could add bss_transition=1 to hostapd.conf.

and i have to add roaming options to every wifi-iface
(can this be done on default_radio0 and radio1? so i don't have to apply to every wifi network?)

config wifi-iface 'roam1'
option device 'radio1'
option ieee80211r '1'
option ft_psk_generate_local '1'
option mobility_domain '1111'
option ft_over_ds '1'
option pmk_r1_push '1'
option time_advertisement '2'
option time_zone 'CET-1CEST,M3.5.0,M10.5.0/3'
option ieee80211k '1'
option bss_transition '1'

[StSaens]

Any idea when this will land in stable?

[zero5]

I've made a new thread but this one could be more useful. Hope someone could help me with xiaomi 3g and 4 routers. I've configured it to work with FT, I see successful FT auth in logs but when my OnePlus 9 phone connect from one AP to another online radio and audio/video calls drops and waits for about minute or two to restore. At the same time switching between wifi and mobile data works much faster. Any ideas what could be the reason for my FT wifi network on these two routers? Not sure if it's related to FT but don't know actually.

[Double-G]

Were the fixes merged into 22.03.4???

[fodiator]

Are you getting the same IP upon roaming?

[zero5]

Yes, ip is same. Continuous ping seems to be ok too, no packages lost

[_FailSafe]

@hnyman

/etc/wifi-suite.sh

I'm not familiar with this tool/script. Is that a homegrown script you would be willing to share? Or is it something available via some OpenWrt package?

[hnyman]

@_FailSafe

@hnyman

/etc/wifi-suite.sh

Is that a homegrown script you would be willing to share?

It is.
And available here:

WPA3: Can I see which encryption each client is using?

Below is a proof-of-concept script providing this output: root@router1:/etc# ./wifi_suite.sh Associated wifi stations' AKM suites: wlan0: AKM suite of e0:c3:77:ae:0a:30 is 00-0f-ac-8 (WPA3-SAE) wlan0: AKM suite of ac:57:75:56:c1:e0 is 00-0f-ac-6 (WPA-PSK-SHA256) wlan1: AKM suite of 30:cd:a7:b3:33:5d is 00-0f-ac-2 (WPA-PSK) Script: #!/bin/sh # Copyright 2021-2023 Hannu Nyman # SPDX-License-Identifier: GPL-2.0-only echo "Associated wifi stations' AKM suites:" cd /var/run/hostapd for socket in …

[_FailSafe]

Thank you!

[_FailSafe]

Sweet! Thanks to your script, I was able to validate that I have some working FT-SAE set up now

root@AP-Office:~# ./wifi-suite.sh
Associated wifi stations' AKM suites:
wl1-ap2: AKM suite of bc:d0:74:xx:xx:xx is 00-0f-ac-9 (FT-SAE)
wl1-ap2: AKM suite of 90:81:58:xx:xx:xx is 00-0f-ac-9 (FT-SAE)

One is an iPhone 12 Pro Max and the other is a MacBook Pro M1.

[djgreg13]

Hello.

How optimise R0KH and R1KH ?
I use WPA3 so I cannot generate psk in local, I have defined R0KH and R1KH in openwrt with MAC of each AP so there is 5 items in my list, 4 AP and a DAWN master controller in a LXC. But we will add in the future 4 new ap so the list will be big

Can I put R0KH the DAWN controller only ?
And which strategy for R1KH ?

[ZebraOnPC]

@huaracheguarache

option iw_qos_map_set

How do you configure option iw_qos_map_set ? what are those numbers ?

[zagi-tng]

I guess they are waiting for Linux kernel 6.x

If you want 802.11r (ft - roaming) then you must use snapshot.

[ralfbergs]

What is the tool you're using in the first screenshot, please?

EDIT: You answered it later, it this tool from Ubiquiti.

[patrakov]

I have tried to follow the WPA3 guide linked below

802.11r Fast Transition how to understand that FT works?

I have not even tried to measure any difference between them. If you wish to try WPA3-SAE on your own, I'll give you some clues. The minimum config you need is to enable 802.11r, and make sure to DISABLE Generate PMK locally (ft_psk_generate_local). This option is currently not working with WPA3. OpenWRT will provide default values for the keys and identifiers, so there's no need to set them: nas_identifier is taken from the BSSID; mobility_domain will be the first 4 hex digits of the md5sum…

It doesn't work on 23.05.2. Reason: r0kh and r1kh do not correctly propagate to hostapd configs.

/etc/config/wireless says:

	list r0kh 'ff:ff:ff:ff:ff:ff * a716-the-rest-is-censored'
	list r1kh '00:00:00:00:00:00 00:00:00:00:00:00 a716-the-rest-is-censored'

However, what ends up in /var/run/hostapd-phy1.conf is:

r0kh=ff:ff:ff:ff:ff:ff
r0kh=mac80211.sh
r0kh=a716-the-rest-is-censored
r1kh=00:00:00:00:00:00
r1kh=00:00:00:00:00:00
r1kh=a716-the-rest-is-censored

According to the post above, word splitting and wildcard expansion are not supposed to happen here.

@Lynx In a private message, you told me that you think that you got it working. Could you please check if you have this issue?

EDIT: solved. /etc/config/wireless should use commas, not spaces.

[cotequeiroz]

Thanks for pointing out the space/comma mixup. I edited the post to correct it. Since it is still useful after 4 years, I'll update the status of FT support in current releases. It is much easier now.

OpenWrt 21.06 and earlier are EOL now, so you should not be using it by now.

If you set option key (should always be the case with LuCI): Starting with OpenWrt 22.03, when not using WPA3, all you need to do to make FT work is to enable 802.11r from LuCI (option ieee80211r '1' in /etc/config/wireless ). With WPA3, including mixed mode, you must disable "Generate PMK locally" in LuCI (option ft_psk_generate_local '0' in /etc/config/wireless). There's no need to touch keys, mobility domain or anything else.

With current snapshots, (and future major releases), the "Generate PMK locally option" will be automatically disabled when using WPA3, and will not even show up in LuCI. It does not mean that if there is an option ft_psk_generate_local '1' in /etc/config/wireless it will be ignored! If it is set to 1, then it will break FT with WPA3/SAE.

For completeness: if you use the wpa_psk_file option (a PSK file) instead of key, then r0kh and r1kh need to be set manually.