Ieee80211w issues : hostpad and wpad configuration? (iPad, IOS)

I am on OpenWrt 21.02.3.

Here's the configuration on /etc/config/wireless :

config wifi-iface 'radio1_net'                 
        option device 'radio1'                  
        option network 'net'                   
        option mode 'ap'                        
        option key REDACTED
        option ssid 'Net'                     
        option encryption 'sae'                 
        option wpa_disable_eapol_key_retries '1'
        option ieee80211w '2'                   
        option isolate '0'                      
        option dtim_period '3'

With the configuration above, I have connection problems (download is slow and patchy).

If I update the above with this:

        option ieee80211w '1'                   

Then it works seamlessly.

I am confused, because I thought it would be fine to require ieee80211w. In fact, I thought it was necessary to use this for WPA3.

In the documentation for ieee80211w, I see :

Enables MFP (802.11w) support (0 = disabled, 1 = optional, 2 = required). Requires the 'full' version of wpad/hostapd and support from the Wi-Fi driver

So I thought maybe I have the wrong package of wpad/hostapd installed ? At the moment, I have wpad-openssl and hostapd-common.

  • Should I use wpad-wolfssl instead of wpad-openssl ?
  • Should I use hostapd-wolfssl or hostapd-openssl instead of hostapd-common ?

Thanks

You have the right packages. The openssl variant has the widest compatibility, and you have the full wpad.

Which router? Which WiFi driver?
(And which client devices? Not all do support w (or r).)

Ps. You might update your router to 22.03.0-rc6
The hostapd/wpad is one year more advanced.

1 Like

While running in mode 1 with the client connected, check the client status with iw dev wlan0 station dump and confirm that MFP (Management Frame Protection, aka ieee80211w) is on. If it is not on the client may not be MFP compatible.

1 Like

Thank you @mk24 and @hnyman.

This is on Netgear Nightawk R7600.

The client device is a recent iPad.
My understanding is that iPad do support MFP.

Running iw dev wlan0 station dump shows only 1 station, which I assume means client. The iPad is not the first client. How can I show all the clients ?

Some version do. There are several threads about Apple devices. Some of them are picky about the exact options.

e.g.

check also your other radios, e.g. iw dev wlan1 station dump

Thanks for the link.

This didn't help, as it also shows only 1 station.

The iPad supports MFP, according to the link to Apple's site.

The problem is squarely with WPA3/ ieee80211w, as switching to psk+aes makes it work without problems.