Wifi Roaming / fast transitioning not working

Hi All,

I'm unable to get the wifi roaming to work, I've tried several configurations as suggested on the forum and also followed the tutorial: https://www.youtube.com/watch?v=kMgs2XFClaM to set it up. All without any result.

My current setup is two accesspoints (Netgear wax220, withOpenWrt 23.05.2 (r23630-842932a63d) ) installed configurations are identical except for the channels as I understood they should be different. both access-points are directly connected to the switch on a tagged port.

I have four vlan (vlan10 - network devices, vlan20 - private outgoing vpn, vlan30 - all clients, vlan40, iot no internet access)

Only vlan30 is enabled for wifi. However when i Enable '802.11r Fast Transition' it simply does not work. I still see the EAPOL-4WAY-HS-COMPLETED in the logs and not the expected 2WAY transitions. I also see a daemon.err hostapd: nl80211: kernel reports: key addition failed error for which i do not understand if it a problem or not.

Below the wireless configuration of WAP1 and WAP2, more the happy to post extra config if needed. Any help would greatly be appreciated as I'm unable to figure this out by my self.

WAP1
config wifi-device 'radio0'
	option type 'mac80211'
	option path 'platform/soc/18000000.wifi'
	option band '2g'
	option htmode 'HE20'
	option cell_density '0'
	option channel '3'
	option log_level '0'
	option country 'NL'

config wifi-device 'radio1'
	option type 'mac80211'
	option path 'platform/soc/18000000.wifi+1'
	option channel '161'
	option band '5g'
	option htmode 'HE80'
	option cell_density '0'
	option log_level '0'
	option country 'NL'

config wifi-iface 'wifinet4'
	option device 'radio0'
	option mode 'ap'
	option ssid 'Get off my LAN'
	option encryption 'sae-mixed'
	option key '<omitted>'
	option ieee80211r '1'
	option ft_over_ds '0'
	option ft_psk_generate_local '1'
	option mobility_domain '123f'
	option nasid '1234'
	option wmm '0'
	option network 'vlan30'

config wifi-iface 'wifinet5'
	option device 'radio1'
	option mode 'ap'
	option ssid 'Get off my LAN'
	option encryption 'sae-mixed'
	option key 'omitted'
	option ieee80211r '1'
	option ft_over_ds '0'
	option ft_psk_generate_local '1'
	option mobility_domain '123f'
	option nasid '1234'
	option network 'vlan30'

config wifi-iface 'wifinet6'
	option device 'radio0'
	option mode 'ap'
	option encryption 'sae-mixed'
	option key 'omitted'
	option network 'vlan30'
	option ssid 'pretty fly for a wifi'
	option ieee80211r '1'
	option ft_over_ds '0'
	option ft_psk_generate_local '1'
	option mobility_domain '234f'
	option nasid '1235'

config wifi-iface 'wifinet7'
	option device 'radio1'
	option mode 'ap'
	option encryption 'sae-mixed'
	option key 'omitted'
	option network 'vlan30'
	option ssid 'pretty fly for a wifi'
	option ieee80211r '1'
	option ft_over_ds '0'
	option ft_psk_generate_local '1'
	option mobility_domain '456f'
	option nasid '1237'

config wifi-iface 'wifinet8'
	option device 'radio0'
	option mode 'ap'
	option ssid 'bloedzuigers'
	option encryption 'psk2'
	option key 'omitted'
	option ieee80211r '1'
	option ft_over_ds '0'
	option ft_psk_generate_local '1'
	option mobility_domain '012a'
	option network 'vlan30'

config wifi-iface 'wifinet9'
	option device 'radio1'
	option mode 'ap'
	option ssid 'bloedzuigers'
	option encryption 'psk2'
	option key 'omitted'
	option ieee80211r '1'
	option ft_over_ds '0'
	option ft_psk_generate_local '1'
	option mobility_domain '012a'
	option network 'vlan30'
WAP2
config wifi-device 'radio0'
	option type 'mac80211'
	option path 'platform/soc/18000000.wifi'
	option band '2g'
	option htmode 'HE20'
	option cell_density '0'
	option channel '11'
	option log_level '0'
	option country 'NL'

config wifi-device 'radio1'
	option type 'mac80211'
	option path 'platform/soc/18000000.wifi+1'
	option channel '140'
	option band '5g'
	option htmode 'HE80'
	option cell_density '0'
	option log_level '0'
	option country 'NL'

config wifi-iface 'wifinet4'
	option device 'radio0'
	option mode 'ap'
	option ssid 'Get off my LAN'
	option encryption 'sae-mixed'
	option key 'omitted!'
	option ieee80211r '1'
	option ft_over_ds '0'
	option ft_psk_generate_local '1'
	option mobility_domain '123f'
	option nasid '1234'
	option wmm '0'
	option network 'vlan30'

config wifi-iface 'wifinet5'
	option device 'radio1'
	option mode 'ap'
	option ssid 'Get off my LAN'
	option encryption 'sae-mixed'
	option key 'omitted!'
	option ieee80211r '1'
	option ft_over_ds '0'
	option ft_psk_generate_local '1'
	option mobility_domain '123f'
	option nasid '1234'
	option network 'vlan30'

config wifi-iface 'wifinet6'
	option device 'radio0'
	option mode 'ap'
	option encryption 'sae-mixed'
	option key 'omitted'
	option network 'vlan30'
	option ssid 'pretty fly for a wifi'
	option ieee80211r '1'
	option ft_over_ds '0'
	option ft_psk_generate_local '1'
	option mobility_domain '234f'
	option nasid '1235'
	option macfilter 'deny'
	list maclist 'omitted'

config wifi-iface 'wifinet7'
	option device 'radio1'
	option mode 'ap'
	option encryption 'sae-mixed'
	option key 'omitted'
	option network 'vlan30'
	option ssid 'pretty fly for a wifi'
	option ieee80211r '1'
	option ft_over_ds '0'
	option ft_psk_generate_local '1'
	option mobility_domain '456f'
	option nasid '1237'
	option macfilter 'deny'
	list maclist omitted''

config wifi-iface 'wifinet8'
	option device 'radio0'
	option mode 'ap'
	option ssid 'bloedzuigers'
	option encryption 'psk2'
	option key 'omitted'
	option ieee80211r '1'
	option ft_over_ds '0'
	option ft_psk_generate_local '1'
	option mobility_domain '012a'
	option network 'vlan30'

config wifi-iface 'wifinet9'
	option device 'radio1'
	option mode 'ap'
	option ssid 'bloedzuigers'
	option encryption 'psk2'
	option key 'omitted'
	option ieee80211r '1'
	option ft_over_ds '0'
	option ft_psk_generate_local '1'
	option mobility_domain '012a'
	option network 'vlan30'

What wifi iface are you trying to roam? As far as I know, sae-mixed does not work with roaming. Try with wpa2.

Thank you for your reply I'm testing with the SSID: bloedzuigers, that is using wpa2-psk. So that should work right?

Yes, I have this configuration, apart from standard configuration:

        option ieee80211r '1'
        option ft_over_ds '0'
        option ieee80211k '1'
        option time_advertisement '2'
        option time_zone 'CET-1CEST,M3.5.0,M10.5.0/3'
        option wnm_sleep_mode '1'
        option bss_transition '1'
        option ft_psk_generate_local '1'

And it works perfectly. Try with it (adjust the time_zone if you want). I don't need to configure mobility domain or nasid (OpenWrt generates it by default). If with that does not work, maybe you have the wrong wpad installed or it's affected by other configurations.

I'll try, I've wpad-basic-mbedtls 2023-09-08-e5ccbfc6-6 installed do you have a different one?

I have the wpad-mbedtls, without basic. I needed for the mesh (802.11s) protocol but I don't know if it is needed for roaming too.

On a sidenote:
See also https://forum.openwrt.org/t/fast-seamless-roaming-through-ethernet-with-openwrt/
The (out of the box) Non-FT roaming is already quite fast - FT roaming might only benefit you when using 802.1X/EAP / during gaming / during Zoom/Teams while moving through your house.

Thank you all for your reply's Ive uninstalled the wpad-basic and installed the wpad full and will do some experiments tomorrow to see if I can make it work. I understand that the roaming will not be the silver bullet in regards to performance gains, but it should work right. I must be doing something wrong.

Unfortunately I'm not able to get this to work, i suspect the device WAX220 is not fully compatible with the current stable openwrt, at least some features do not seem to work yet. For example I'm also experiencing slow upload speeds like described in this post (also a netgear wax2.. series) WAX206 Slow Upload Speeds

The device is stable but there must be something not fully compatible, I'll try the snapshot this week which is from the 22 of Jan to see it that helps. Thanks for the help so far an will keep you posted.

This does come up often and I usually lurk on this topic.

However the last time it came up I , again, went to the web to get feedback that is not so much OpenWrt centric.

I was surprised to find some devices just do not like to roam. Android was specifically mentioned in this list.
So if you have one or two devices that have no problem and a few stubborn ones, look around for the stubborn ones outside OpenWrt.

You never mentioned if it was all devices or some. All or some would, pretty much, answer that postulation.

Have you started with a configuration that has fast roaming disabled entirely, and just focused on tuning the radios to get your devices to roam that way?

The process starts with channel selection (non-overlapping channels) and power levels (almost always reducing the power), as well as physical placement of the APs. Done properly, this will setup a roaming situation where client devices will roam nearly seamlessly from one AP to another as you move through the space.

Only after that is done should you attempt to use 802.11r (and/or the k/v standards). Those must have a solid foundation to work properly. And, FWIW, these additional standards can cause problems on some devices where roaming would be fine without.

2 Likes

Hi LilRedDog,

I've tested it with a Mac (Sanoma 14.2.1 (23C71)) and a Android phone (version 14) both did not roam, I can also test with a windows machine to see it that does work. But first I'll try the optimization as suggested by psherman. Will keep you posted.

Hi psherman, I'll try this and see if it helps, please bare with me I cannot freely test hence the kids and wife are also using it so I need to find some sparse test time.

But thank you for the the link, it looks promissing and indeed maybe the whole FT/Fast roaming is not needed it properly set up.

Is Wi-Fi assist turned on , on the phones?

Hi dnns, I have exactly the same problem as you but on the Zyxel wsm20 with a very similar network layout as yours. I also cannot get any of my devices to roam with any of the available openwrt tools I tried. Once a devices log into any of the AP it seems to hook onto it and never move even when i move to a location where the other AP are -70dBm ! Really weird.
Did you ever make any progress with yours ? maybe you can give me some hints as I'm running out of things to try.
thanks.

Hi Andy,

Unfortunately no, I did tweak the power settings to better facilitate the switching over from one AP to the other, however it always resulted in a 4WAY handshake instead of the 2WAY it supposed to do.

For now I'm just giving up and hope that it will be fixed in a future release, but to be fair I can live without it, but it would be nice to have it working, should you manage to get it work, i would be really interested.

KR,
Dennis

yes, I've reached the same conclusion. I actually mapped the entire house to read dBm levels and entered into spreadsheet to make sure roaming should be happening. I tried openwrt 802.11s with mesh11sd, with and without 802.11r then tried with 'dawn' package. Everything confirmed what I already knew. I think either openwrt or zyxel have some issues when it comes to roaming. I'm also leaving it here for now since there's is nothing else I can do. A lot of topics talk about placement and power changes, I tried all of that and still nothing. The data just doesn't tie up with the practice. You would think if one AP shows 30dBms and the other 80dBms then roaming should not only happen it's difficult to see how it cannot; yet all my modern android phones, laptops and tablets just stick to the AP they first log onto.
thanks for your reply.

I had the same problem and the only way to make roaming happening was using usteer.

Possibly this https://github.com/openwrt/openwrt/pull/14620 will solve the issue in certain scenarios

maybe, but after days troubleshooting I decided to reload oem firmware and sell all 4 of them on. My other mesh (velop in bridge mode) works flawlessly. The main problem with the zyxel was IP routing loss between main and nodes. When this happens power off/on nodes and resetting main node mesh wifi still doesn't bring them back so i have to physcially move them to the main router/switch and reconnect them, after that all is fine again until next time. My backhaul is all wifi6-AX ch100.
thanks for everyone's contribution, but I have to say goodbye to these zyxel. My next mesh will be from a more reputable company and tri-band since wired backhaul is impossible for me.