Amazon FireTV Stick >AP-STA-POSSIBLE-PSK-MISMATCH @ Xiaomi Redmi Router AC2100

ThomasCr · September 4, 2021, 4:56pm

Hi,

I cant connect my new FireTV Stick to my new Xiaomi Redmi Router AC2100 witch runs OpenWRT 21.02.0-rc4.

The funny thing is, when I move the stick near my other WiFi AP with a D-link DAP-2695-A2 which also runs OpenWRT 21.02.0-rc4 it works.

On my Redmi Router I get the message:
Sat Sep 4 18:43:13 2021 daemon.notice hostapd: wlan5g: AP-STA-POSSIBLE-PSK-MISMATCH 80:6d:71:a2:XX:XX

Also on the FireTV I get the message for authentication problem. I have the password transferred with WPS-Key function.

My WiFi setup for wlan2g and wlan5g interfaces are the same...

config wifi-iface 'wlan2g'
        option device 'radio0'
        option network 'lan'
        option mode 'ap'
        option ssid 'SSID'
        option key 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
        option wpa_group_rekey '300'
        option wps_pushbutton '1'
        option ifname 'wlan2g'
        option encryption 'sae-mixed'
        option ieee80211w '1'
        option wpa_disable_eapol_key_retries '1'
        option ieee80211r '1'
        option nasid '64644AXXXXXX'
        option mobility_domain '4c8a'
        option ft_over_ds '1'
        option ft_psk_generate_local '1'
        option r1_key_holder '64644AXXXXXX'
        list r0kh '64:64:4A:XX:XX:XX,64644AXXXXXX,XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
        list r0kh '64:64:4A:XX:XX:XX,64644AXXXXXX,XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
        list r0kh 'A4:2B:B0:XX:XX:XX,A42BB0XXXXXX,XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
        list r0kh 'A4:2B:B0:XX:XX:XX,A42BB0XXXXXX,XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
        list r0kh '14:CC:20:XX:XX:XX,14CC20XXXXXX,XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
        list r0kh '14:CC:20:XX:XX:XX,14CC20XXXXXX,XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
        list r1kh '64:64:4A:XX:XX:XX,64:64:4A:XX:XX:XX,XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
        list r1kh '64:64:4A:XX:XX:XX,64:64:4A:XX:XX:XX,XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
        list r1kh 'A4:2B:B0:XX:XX:XX,A4:2B:B0:XX:XX:XX,XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
        list r1kh 'A4:2B:B0:XX:XX:XX,A4:2B:B0:XX:XX:XX,XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
        list r1kh '14:CC:20:XX:XX:XX,14:CC:20:XX:XX:XX,XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
        list r1kh '14:CC:20:XX:XX:XX,14:CC:20:XX:XX:XX,XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'

config wifi-iface 'wlan5g'
        option device 'radio1'
        option network 'lan'
        option mode 'ap'
        option ssid 'SSID'
        option key 'XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
        option wpa_group_rekey '300'
        option ifname 'wlan5g'
        option encryption 'sae-mixed'
        option ieee80211w '1'
        option wpa_disable_eapol_key_retries '1'
        option ieee80211r '1'
        option nasid '64644AXXXXXX'
        option mobility_domain '4c8a'
        option ft_over_ds '1'
        option ft_psk_generate_local '1'
        option r1_key_holder '64644AXXXXXX'
        list r0kh '64:64:4A:XX:XX:XX,64644AXXXXXX,XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
        list r0kh '64:64:4A:XX:XX:XX,64644AXXXXXX,XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
        list r0kh 'A4:2B:B0:XX:XX:XX,A42BB0XXXXXX,XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
        list r0kh 'A4:2B:B0:XX:XX:XX,A42BB0XXXXXX,XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
        list r0kh '14:CC:20:XX:XX:XX,14CC20XXXXXX,XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
        list r0kh '14:CC:20:XX:XX:XX,14CC20XXXXXX,XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
        list r1kh '64:64:4A:XX:XX:XX,64:64:4A:XX:XX:XX,XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
        list r1kh '64:64:4A:XX:XX:XX,64:64:4A:XX:XX:XX,XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
        list r1kh 'A4:2B:B0:XX:XX:XX,A4:2B:B0:XX:XX:XX,XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
        list r1kh 'A4:2B:B0:XX:XX:XX,A4:2B:B0:XX:XX:XX,XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
        list r1kh '14:CC:20:XX:XX:XX,14:CC:20:XX:XX:XX,XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'
        list r1kh '14:CC:20:XX:XX:XX,14:CC:20:XX:XX:XX,XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX'

This is the first client who has problems to connect....my D-Link AP has also the same wireless config. Any idea how to fix this?

StephenR0 · September 4, 2021, 5:24pm

I've had this problem with Raspberry Pi 4 before. This problem is discussed in this thread.

github.com/raspberrypi/linux

[Pi 4] Other machines cannot connect to wireless AP when ieee80211w=1

opened 05:00PM - 18 May 20 UTC

hvenev

**Is this the right place for my bug report?** It might be related to brcmfmac …firmware. I am using the firmware from https://github.com/RPi-Distro/firmware-nonfree **Describe the bug** It looks like brcmfmac does not support ieee80211w/MFP in AP mode. Clients are unable to connect to the network because the RSN IE message during handshake is different from the one in the beacon frame. Disabling ieee80211w fixes the issue. If I run the same hostapd.conf on my laptop (iwlwifi/iwlmvm), my phone connects to it just fine. **To reproduce** hostapd.conf: ``` ctrl_interface=/var/run/hostapd ctrl_interface_group=wheel driver=nl80211 macaddr_acl=0 wmm_enabled=1 country_code=BG ignore_broadcast_ssid=0 hw_mode=g ieee80211n=1 ieee80211w=1 ieee80211d=1 channel=6 interface=wlan0 ssid=REDACTED wpa=2 wpa_key_mgmt=WPA-PSK rsn_pairwise=CCMP wpa_passphrase=REDACTED ``` **Expected behaviour** Clients can connect to the network. **Actual behaviour** Clients cannot connect to the network. **System** Device: Raspberry Pi 4 Model B Rev 1.2 Kernel: rpi-5.6.y from 5377449ffb6ffe9ebfee939d52b2611130fbb836 Firwmare version: May 11 2020 18:59:41, 21bfdeee3a6ea823e2113b983390acd1eec8edfb (clean) (release) (start) OS: Fedora 32 aarch64 hostapd: hostapd-2.9-3.fc32.aarch64 **Logs** No errors appear on the Pi. Here is what happens on my laptop when it tries to connect: ``` wpa_supplicant: wlan: SME: Trying to authenticate with dc:a6:32:87:2a:8d (SSID='REDACTED' freq=2437 MHz) kernel: wlan: authenticate with dc:a6:32:87:2a:8d kernel: wlan: send auth to dc:a6:32:87:2a:8d (try 1/3) wpa_supplicant: wlan: Trying to associate with dc:a6:32:87:2a:8d (SSID='REDACTED' freq=2437 MHz) kernel: wlan: authenticated kernel: wlan: associate with dc:a6:32:87:2a:8d (try 1/3) kernel: wlan: RX AssocResp from dc:a6:32:87:2a:8d (capab=0x411 status=0 aid=1) wpa_supplicant: wlan: Associated with dc:a6:32:87:2a:8d wpa_supplicant: wlan: CTRL-EVENT-SUBNET-STATUS-UPDATE status=0 kernel: wlan: associated wpa_supplicant: wlan: WPA: IE in 3/4 msg does not match with IE in Beacon/ProbeResp (src=dc:a6:32:87:2a:8d) wpa_supplicant: WPA: RSN IE in Beacon/ProbeResp - hexdump(len=22): 30 14 01 00 00 0f ac 04 01 00 00 0f ac 04 01 00 00 0f ac 02 0c 00 wpa_supplicant: WPA: RSN IE in 3/4 msg - hexdump(len=26): 30 18 01 00 00 0f ac 04 01 00 00 0f ac 04 02 00 00 0f ac 02 00 0f ac 08 0c 00 kernel: wlan: deauthenticating from dc:a6:32:87:2a:8d by local choice (Reason: 17=IE_DIFFERENT) wpa_supplicant: wlan: CTRL-EVENT-DISCONNECTED bssid=dc:a6:32:87:2a:8d reason=17 locally_generated=1 ```

You can see if it's similar by setting WPA2 and disabling 802.11w. If that works, it sounds similar.

ThomasCr · September 4, 2021, 5:28pm

I was thinking, maybe when I push the key with WPS it get bond to the BSSID - and I pushed the key with 2g interface.

But for a test I activated wps also on the 5g interface, deleted the wifi on the firetv stick and pushed it again with the 5g interface with the same problem

at least I got it running:
not funny - but I entered my 63 char long WPA key and this was working.

What ever is different when I enter it manually.... :woozy_face

When I did the first setup of the stick I was close to the D-Link AP and also used the WPS feature.

ThomasCr · February 1, 2022, 6:34pm

Just wanted to report back - this problem was coming back on a lot of other devices.

on two Huawai Mate 10 pro devices from my sons running Android 10
my Lenovo T430 running Windows 10

The funny thing is, it was not related to my Redmi AC2100 - I got the problem also on my TP-Link Archer C2600 on 21.02.1 - which I replaced the AC2100 with, because the Redmi is not compatible with 19.07

It seams a problem in 21.02 - I wonder if I am the only one. I twitched now back to 19.07 on my Archer C2600 with the same wifi settings, I was running 21.02. The only thing I am missing is dawn....

Oh and I really tested with simple wifi config like:

        option encryption 'psk2+ccmp'
        option wpa_disable_eapol_key_retries '0'
        option wpa_group_rekey '300'
        option wps_pushbutton '1'
        option tdls_prohibit '0'
        option ieee80211w '0'
        option ieee80211r '1'
        option ft_over_ds '1'
        option ft_psk_generate_local '1'

I did also a test where I switched ieee80211r to 0

Maybe it is also related to dawn.... but I am happy now to have a running setup.