802.11r IPhone can not connect

[JuliusBairaktaris]

I am trying to set up Band Steering using Dawn on my ax3600 with snapshot [r21995-059263dd6e]. When I enable 802.11r, the IPhones on the network running the latest IOS 16.3 can no longer connect to the network. All other devices, even printers and such, connect without a problem.

I have two APs with the same password and SSID running on the 2.4 GHz and 5 GHz bands respectively

What i tried so far:
Default LuCI config for 802.11r
Setting NASID to different values on each AP
WPAD-openssl, WPAD-Wolfssl and the new wpad-mbedtls
Setting Reassociation Deadline to 20000 (https://github.com/openwrt/openwrt/issues/7907)
Setting DTIM Interval to 2

My wifi config:

	option device 'radio1'
	option network 'lan'
	option mode 'ap'
	option ssid '***'
	option key '***'
	option encryption 'sae-mixed'
	option ieee80211k '1'
	option time_advertisement '2'
	option time_zone 'CET-1CEST,M3.5.0,M10.5.0/3'
	option wnm_sleep_mode '1'
	option bss_transition '1'


	option device 'radio2'
	option network 'lan'
	option mode 'ap'
	option ssid '***'
	option key '***'
	option encryption 'sae-mixed'
	option ieee80211k '1'
	option time_advertisement '2'
	option time_zone 'CET-1CEST,M3.5.0,M10.5.0/3'
	option wnm_sleep_mode '1'
	option bss_transition '1'

[rossini]

i think there was also an issue with sae-mixed in combi with fastroaming. What happen if you try wpad2 or wpad3?

[JuliusBairaktaris]

Setting to either WPA2 or WPA3 solves the issue.
Is there any other workaround to this since I would like to use WPA3 but not all of my clients support it.
Is it fine if only the 2.4GHz channel has WPA2 and the 5Ghz has WPA3?

[rossini]

see https://github.com/openwrt/openwrt/issues/7858

My „workaround“ was to disable ft at all.

[JuliusBairaktaris]

It is a requirement for DAWN so that's not an option either.

Edit: its not a requirement so i will drop it. Thanks for the Info
"If 802.11r is enabled for fast, seamless transfer of a device across AP's then it enhances the overall user experience, but DAWN doesn't directly use it." https://github.com/berlin-open-wireless-lab/DAWN/blob/master/README.md

[bjo]

I also stumpled upon this issue with SAE-Mixed and FT enabled with an IPhone XR (16.3) and an IPad 9th gen (16.3). Switching to WPA2 (as some clients don't support WPA3) "fixed" it. 802.11w was turned off, as I remembered some older Apple devices has problems with it, but those devices now are new.

[anom3]

I have 2 AX3600 being delivered in about 3 to 4 hours.

I am fairly well versed in wireless roaming (k/v/r, neighbor reports, ft, sending out bss transition requests etc etc etc).

As it stands now on my current APs, ft works perfectly. I am swapping 2 of my APs out for these AX3600. Installing OpenWRT on them right away of course.

I do not / will not be using WPA3...

I have a small basket of clients that can properly use FT including 3 android devices as well as an ios device.

Although this doesn't apply to the AX3600 as its currently snapshot only.. 802.11r is / was broken using even the most latest stable build (22.03?). With fairly recent snapshots, without touching log_level in /etc/config/wireless you should be seeing this in your logs:

Mon Feb 27 13:15:57 2023 daemon.notice hostapd: phy1-ap0: AP-STA-CONNECTED xx:xx:xx:xx:xx:xx auth_alg=ft

Will post back here if the AX3600 with the most current build, WPA3 turned off and 802.11r turn on allows clients to seamlessly roam. I have a good base level to compare to... I can walk across my 3 floor (concrete) home maintaining a sub 10ms ping to my primary gateway without any packet loss, all while connected to only my 5.8ghz band. 2 of my APs are getting swapped for the AX3600s which raw hardware wise are much better than whats in place there now.

[jkdf2]

I've observed the same, on the current snapshot with my dev iPhone X running iOS 16.7.7

Only WPA2 or WPA3, not WPA2+WPA3 Mixed Mode, works ok.

[frollic]

@jkdf2

WPA2+WPA3 Mixed Mode

Doesn't actually provide any additional security over WPA2, so there's no point in using it.

Plus, several clients have issues with it.

[jkdf2]

Good to note. I actually moved to up to WPA3-only rather than down to WPA2-only.

[jkdf2]

Actually, on WPA3-only, 802.11r simply is not working - specifically, there are no auth_alg=ft events and my Android and iOS test devices perform a full handshake when switching BSSIDs.

[ej_breaks_the_lan]

I have FT working to some degree while testing exclusively with iOS devices on 23.05. I have WPA3 enabled as well.

802.11r Fast Transition how to understand that FT works?

I have not even tried to measure any difference between them. If you wish to try WPA3-SAE on your own, I'll give you some clues. The minimum config you need is to enable 802.11r, and make sure to DISABLE Generate PMK locally (ft_psk_generate_local). This option is currently not working with WPA3. OpenWRT will provide default values for the keys and identifiers, so there's no need to set them: nas_identifier is taken from the BSSID; mobility_domain will be the first 4 hex digits of the md5sum…

I believe the only other non-default setting I used was

reassociation_deadline=20000

802.11r Fast Transition how to understand that FT works?

Just documenting here, that I got the 802.11r functioning after I increased the reassociation_deadline to 20000 (from the default of 1000), based on advice from the discussions at Rekeying Issue - “driver can’t safely do that.” - #18 by dsouza and https://bugs.openwrt.org/index.php?do=details&task_id=3159 . My Android 11 tablet roamed between ipq806x/R7800 with ath10k-ct wifi in 802.11ac mode (VHT160) mt7622/RT3200 with mt76 wifi in 802.11ax mode (HE80) (So the even AC/AX mode differen…

I have a shared ESSID between both bands and two access points. When it doesn't work, I see errors such as:

daemon.err hostapd: nl80211: kernel reports: key addition failed
daemon.notice hostapd: FT: Missing required pairwise in pull response from xx:xx:xx:xx:xx:xx

When it does work, I've switched APs as expected. I believe that I've also hopped/steered (edit: via usteer) from the 2.4Ghz band to 5Ghz without a full handshake. But going from 5Ghz to 2.4GHz, I get a full handshake.

[jkdf2]

I've actually got it fully working now on WPA3-only with after configuring r0kh and r1kh correctly.

Got a draft in progress to update the Wiki to help others.

[cotequeiroz]

Setting r0kh and r1kh should not be mandatory, except if you use a password file and do not set a regular password. Keys are supposed to be random; manually changing them should not make a difference. If you have a PSK set, and FT does not work without setting r0kh and r1kh, then there is a bug that needs to be fixed! Can you share a group configurations that does NOT work so that I can take a look at it? I will need SSID and key, unfortunately, as they are both used to compute the default r[01]kh secret. You could perhaps create a dummy SSID/key combination, test it to make sure it is broken, post them, along with contents of /var/run/hostapd*.conf. After adding r0kh and r1kh settings and making sure they work, send /var/run/hotapd*.conf again. You may omit other bss=/interface= blocks from hostapd*.conf.

I know Apple devices are troublesome, and there are many settings that actually affect roaming behavior that we need to worry about: ft_over_ds, reassociation_deadline, pmk_r1_push, ft_generate_local, even DFS channels, to name a few. r0kh and h1kh secrets are not even seen by the clients, they are used to encrypt communication between APs only.

[jkdf2]

@cotequeiroz

Setting r0kh and r1kh should not be mandatory, except if you use a password file and do not set a regular password. Keys are supposed to be random; manually changing them should not make a difference. If you have a PSK set, and FT does not work without setting r0kh and r1kh, then there is a bug that needs to be fixed!

Are you sure? Like for @ej_breaks_the_lan, it was your post that, for me, clued me into needing to specify an r0kh and r1kh!

802.11r Fast Transition how to understand that FT works?

I have not even tried to measure any difference between them. If you wish to try WPA3-SAE on your own, I'll give you some clues. The minimum config you need is to enable 802.11r, and make sure to DISABLE Generate PMK locally (ft_psk_generate_local). This option is currently not working with WPA3. OpenWRT will provide default values for the keys and identifiers, so there's no need to set them: nas_identifier is taken from the BSSID; mobility_domain will be the first 4 hex digits of the md5sum…

And your follow-up post here:

802.11r Fast Transition how to understand that FT works?

Basically, assuming you're running 21.02 or master and configuring from luci, you just need to turn 802.11r on and disable 'Generate PMK locally'. Leave the r0kh and r1kh empty. OpenWrt will generate a key for you. Test it with just that to see if it works. The caveat is that it will only use the mobility domain to do so, meaning it will only generate 65536 possible keys, vs 3.403E+38 if you set your own. If you don't set your own mobility domain, then anyone can use the same recipe to comp…

If you're certain that simply enabling 802.11r with WPA3-SAE should simply work, I can certainly try to provide a minimally reproducible config when my wife isn't in the middle of some AWS exam studies.

[LilRedDog]

I wonder if Wi-Fi assist being on helps iPhones with FT?

I don't need FT now but when I had APs using it (they were all wired) I never had a problem, but I also use Wi-Fi assist; just to let go of weak Wi-Fi and get on wireless data ASAP.

Just rambling.

[qunvureze]

Apple WiFi setup guidance docs don't mention "Wi-Fi Assist", but feel free to try.

About wireless roaming for enterprise - Apple Support

Wi-Fi roaming support in Apple devices

Note that they don't mention enabling fast roaming and other extra features for home users: https://support.apple.com/en-us/102766
"fast" in "fast roaming" means that, after a device decides by itself to switch to another BSSID, it won't have to go through the full authentication process. It is already typically fast enough without 802.11r when using WPA2-PSK or WPA3-SAE.

[Videopac]

So, to reduce iPhone issues disable 802.11r fast roaming?

[qunvureze]

Yes. If you can’t find any obvious reason for your problems in logs or internets, you need to do trial and error troubleshooting. Start with vanilla OpenWrt WiFi settings and see if that works.

[jkdf2]

Because @rkboni messaged me asking if I had updated the Wiki yet - I haven't as I wanted to retest and see what my situation looked like. Unfortunately looks like I don't have a successful config that works with iOS devices.

Quick summary of current status & findings:

• One device running OpenWrt 23.05.4 | hostapd-common 2023-09-08-e5ccbfc6-7
• Other device running a current snapshot OpenWrt SNAPSHOT r27143-0b7d99147b | hostapd-common 2024.03.09~695277a5-r3
• WPA3-only network
• I have confirmed that both devices set r0kh and r1kh automatically to the same value if field left empty as @cotequeiroz stated
• Whether I let r0kh and r1kh be set automatically or set it manually, an iPhone I have on hand fails to roam.
• 802.11r default config with reassociation deadline set to 2000

Sometimes,

daemon.err hostapd: nl80211: kernel reports: key addition failed
FT: Missing required pairwise in pull response from <other_router>

appears in logs and iPhone falls back to a full handshake.

Other times, I just get a constant spam of:

daemon.err hostapd: nl80211: kernel reports: key addition failed
daemon.debug hostapd: wl1-ap0: STA <iphone> IEEE 802.11: binding station to interface 'wl1-ap0'
daemon.debug hostapd: wl1-ap0: STA <iphone> IEEE 802.11: authentication OK (FT)
daemon.debug hostapd: wl1-ap0: STA <iphone> MLME: MLME-AUTHENTICATE.indication(<iphone>, FT)
daemon.debug hostapd: wl1-ap0: STA <iphone> IEEE 802.11: association OK (aid 2)
daemon.info hostapd: wl1-ap0: STA <iphone> IEEE 802.11: associated (aid 2)
daemon.notice hostapd: wl1-ap0: AP-STA-CONNECTED <iphone> auth_alg=ft
daemon.debug hostapd: wl1-ap0: STA <iphone> MLME: MLME-REASSOCIATE.indication(<iphone>)
daemon.debug hostapd: wl1-ap0: STA <iphone> IEEE 802.11: binding station to interface 'wl1-ap0'
daemon.debug hostapd: wl1-ap0: STA <iphone> WPA: event 6 notification
daemon.debug hostapd: wl1-ap0: STA <iphone> WPA: FT authentication already completed - do not start 4-way handshake
daemon.notice hostapd: wl1-ap0: AP-STA-DISCONNECTED <iphone>

This continues multiple times a second and the iPhone never actually successfully transitions over.