SA Query timeout

martinii · Thu Aug 17, 2023 10:53 pm

Hi all,

I have problem with my father's phone (Samsung A3 2016, stock OS) in my wifi network. I had Mikrotik hAP lite before and there was absolutely no problems! Now I have Mikrotik hAP ax2 and my Dad can't connect to my wifi because of SA Query timeout error. I have few devices (phones, laptops and TV) in my wireless network and there is problem ONLY with this one device... I upgraded router os few times and now i'm on 7.11 stable. I tried Disable PMKID = YES but without success either. Look:

This is part of my configuration:

# 2023-08-17 21:35:25 by RouterOS 7.11
# software id = **ELIDED**
#
# model = C52iG-5HaxD2HaxD
# serial number = XXXXXXXXXXXX
/interface bridge
add name=bridge-LAN
/interface ethernet
set [ find default-name=ether1 ] mac-address=XX:XX:XX:XX:XX:XX
/interface wifiwave2 channel
add band=2ghz-n disabled=no frequency=2447 name=channel-2.4GHz \
    skip-dfs-channels=all width=20mhz
add band=5ghz-ax disabled=no frequency=5280 name=channel-5GHz width=20/40mhz-eC
/interface wifiwave2 security
add authentication-types=wpa2-psk disable-pmkid=yes disabled=no encryption="" \
    name=sec-profile
/interface wifiwave2 configuration
add channel=channel-2.4GHz country=Poland disabled=no mode=ap name=cfg-2.4GHz \
    security=sec-profile ssid=KMPM_nomap
add channel=channel-5GHz country=Poland disabled=no mode=ap name=cfg-5GHz \
    security=sec-profile ssid=KMPM_nomap
/interface wifiwave2
set [ find default-name=wifi2 ] channel=channel-2.4GHz channel.frequency=2447 \
    configuration=cfg-2.4GHz configuration.mode=ap disabled=no name=2.4GHZ
set [ find default-name=wifi1 ] channel=channel-5GHz configuration=cfg-5GHz \
    configuration.mode=ap disabled=no name=5GHz
/ip pool
add name=pool-dhcp ranges=192.168.44.10-192.168.44.35
add name=dhcp_pool1 ranges=192.168.44.2-192.168.44.254
/ip dhcp-server
add address-pool=pool-dhcp insert-queue-before=bottom interface=bridge-LAN \
    lease-time=3d name=dhcp1
/interface bridge port
add bridge=bridge-LAN interface=ether2
add bridge=bridge-LAN interface=ether3
add bridge=bridge-LAN interface=ether4
add bridge=bridge-LAN interface=ether5
add bridge=bridge-LAN interface=5GHz
add bridge=bridge-LAN interface=2.4GHZ
/ip dhcp-server lease
add address=192.168.44.24 client-id=1:a8:9c:ed:4e:b3:ad mac-address=\
    XX:XX:XX:XX:XX:XX server=dhcp1
add address=192.168.44.23 client-id=1:94:be:46:cf:1:76 comment="Tablet Matika" \
    mac-address=XX:XX:XX:XX:XX:XX server=dhcp1
add address=192.168.44.21 client-id=1:78:af:8:80:97:b5 mac-address=\
    XX:XX:XX:XX:XX:XX server=dhcp1
add address=192.168.44.20 client-id=1:20:34:fb:cb:e2:f8 mac-address=\
    XX:XX:XX:XX:XX:XX server=dhcp1
add address=192.168.44.19 client-id=1:8c:c8:cd:59:a2:99 comment="TV SAMSUNG" \
    mac-address=XX:XX:XX:XX:XX:XX server=dhcp1
add address=192.168.44.18 client-id=1:bc:60:a7:cd:db:c5 comment=PS4 \
    mac-address=XX:XX:XX:XX:XX:XX server=dhcp1
/ip dhcp-server network
add address=192.168.44.0/24 gateway=192.168.44.1

Help needed....

Fri Aug 18, 2023 12:22 am

I'm terrible at RouterOS WiFi, but a few things in your config raised questions:

1. Why disable PMKID? According to the docs, "Disabling PMKID can cause compatibility issues with client devices which make use of it."

2. encryption=""? Is that just you being over-zealous with the config sanitization, or do you really have all encryption methods disabled?

gigabyte091 · Fri Aug 18, 2023 6:29 am

I suggest you to send supout file and log to the support. I had similar problem and i sent them file and log but my AC but problem fixed itself...

Fri Aug 18, 2023 8:24 am

Quick response before leaving for the road trip to France...

2. encryption=""? Is that just you being over-zealous with the config sanitization, or do you really have all encryption methods disabled?

If you use WInbox, make sure that section is folded in.
NOT opened and nothing selected. Is not the same.

nescafe2002 · Fri Aug 18, 2023 12:15 pm

Try disabling band steering. I noticed these SA Query Timeout messages just before re-associating with another radio.

https://help.mikrotik.com/docs/display/ ... properties

/interface wifiwave2 configuration set [find] rrm=no wnm=no

martinii · Fri Aug 18, 2023 10:54 pm

I'm terrible at RouterOS WiFi, but a few things in your config raised questions:

1. Why disable PMKID? According to the docs, "Disabling PMKID can cause compatibility issues with client devices which make use of it."

2. encryption=""? Is that just you being over-zealous with the config sanitization, or do you really have all encryption methods disabled?

1. It was only for testing. But without success so returned to default.
2. I missed it out! I had nothing checked indeed... Now i have CCMP and GCMP.

Try disabling band steering. I noticed these SA Query Timeout messages just before re-associating with another radio.

https://help.mikrotik.com/docs/display/ ... properties
Code: Select all
/interface wifiwave2 configuration set [find] rrm=no wnm=no

So you suggest to leave only frequencies?

İmposss · Sat Aug 19, 2023 1:01 am

An issue that came with version 7.11. I reverted to version 7.10.2

nescafe2002 · Sat Aug 19, 2023 3:16 pm

Try disabling band steering. I noticed these SA Query Timeout messages just before re-associating with another radio.
So you suggest to leave only frequencies?

I suggested to disable band steering, as this was introduced in 7.11:

*) wifiwave2 - added "steering" parameters and menu to set up and monitor AP neighbor groups (CLI only)

An issue that came with version 7.11. I reverted to version 7.10.2

Again, band steering is introduced in 7.11, therefore may be related to these issues.

İmposss · Mon Aug 21, 2023 3:20 am

Try disabling band steering. I noticed these SA Query Timeout messages just before re-associating with another radio.

https://help.mikrotik.com/docs/display/ ... properties
Code: Select all
/interface wifiwave2 configuration set [find] rrm=no wnm=no

Hi i tried it doesn't work

/interface wifiwave2 configuration set [find] steering.rrm=no steering.wnm=no

gigabyte091 · Mon Aug 21, 2023 6:41 am

Did you try to contact Mikrotik support ? At this point they maybe can help you more.

martinii · Mon Aug 28, 2023 6:47 pm

I tried disable steering but no luck... Well I feel it doesn't matter what I do - it always doesn't work... On hAP ac lite no problems, on ax2 it still doesn't work...

Mon Aug 28, 2023 7:31 pm

Did you try to contact Mikrotik support ? At this point they maybe can help you more.

Best recommendation to get... create supout.rif, contact support.

İmposss · Mon Aug 28, 2023 7:34 pm

Did you try to contact Mikrotik support ? At this point they maybe can help you more.
Best recommendation to get... create supout.rif, contact support.

I did, waiting for support

maigonis · Tue Aug 29, 2023 1:44 am

Try WPA2 only to isolate issue to security settings.

martinii · Tue Aug 29, 2023 10:47 am

I tried WPA2 only. As well as firmware upgrading, disabling band steering, disabling PMKID, turning off encription, disabling 5GHz radio and rebooting donzens times....

Rox169 · Tue Aug 29, 2023 11:04 am

did you tried to delete/forget the network in mobile and do new connect???

martinii · Tue Aug 29, 2023 2:00 pm

Every time when I made some changes in router settings.

İmposss · Fri Sep 01, 2023 4:02 pm

solution for me:

/interface/wifiwave2/configuration> set [find] security.connect-priority=0/1

alibloke · Mon Sep 25, 2023 10:12 am

This appears to work, my laptop has been able to fast roam for the first time and the dreaded SA Query Timeout message is gone. I must admit I don't understand why and I'm concerned that it's working at the cost of security, specifically MacStealer attacks as per this post:
viewtopic.php?t=198228#p1016424

Can anyone elaborate on what this setting actually does?

ToTheFull · Mon Sep 25, 2023 1:01 pm

solution for me:

/interface/wifiwave2/configuration> set [find] security.connect-priority=0/1

This appears to work, my laptop has been able to fast roam for the first time and the dreaded SA Query Timeout message is gone. I must admit I don't understand why and I'm concerned that it's working at the cost of security, specifically MacStealer attacks as per this post:
viewtopic.php?t=198228#p1016424

Can anyone elaborate on what this setting actually does?

Yes please do, tired of this in my logs all the time when someone walks into the kitchen.

/log print where message~"C6"
 09-22 12:24:54 wireless,info C6:6B:0C@wifi1 connected, signal strength -61
 09-22 12:26:44 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -73
 09-22 12:26:44 wireless,info C6:6B:0C@wifi1 connected, signal strength -75
 09-22 12:27:26 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -68
 09-22 12:27:27 wireless,info C6:6B:0C@wifi1 connected, signal strength -71
 09-22 12:27:55 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -69
 09-22 12:27:55 wireless,info C6:6B:0C@wifi1 connected, signal strength -71
 09-22 12:29:58 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -68
 09-22 12:30:22 wireless,info C6:6B:0C@wifi1 connected, signal strength -68
 09-22 12:31:44 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -71
 09-22 12:31:55 dhcp,info defconf deassigned 192.168.0.106 for C6:6B:0C
 09-22 12:31:56 dhcp,info defconf assigned 192.168.0.106 for C6:6B:0C 
 09-22 12:31:58 wireless,info C6:6B:0C@wifi1 connected, signal strength -71
 09-22 12:32:24 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -73
 09-22 12:32:24 wireless,info C6:6B:0C@wifi1 connected, signal strength -75
 09-22 12:32:33 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -72
 09-22 12:32:34 wireless,info C6:6B:0C@wifi1 connected, signal strength -75
 09-22 12:32:38 dhcp,info defconf deassigned 192.168.0.106 for C6:6B:0C 
 09-22 12:32:39 dhcp,info defconf assigned 192.168.0.106 for C6:6B:0C 
 09-22 12:32:49 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -70
 09-22 12:32:50 wireless,info C6:6B:0C@wifi1 connected, signal strength -73
 09-22 12:34:18 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -77
 09-22 12:34:19 wireless,info C6:6B:0C@wifi1 connected, signal strength -76
 09-22 12:38:17 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -71
 09-22 12:38:17 wireless,info C6:6B:0C@wifi1 connected, signal strength -70
 09-22 12:42:13 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -70
 09-22 12:42:20 wireless,info C6:6B:0C@wifi1 connected, signal strength -65
 09-22 12:47:26 wireless,info C6:6B:0C@wifi1 disconnected, connection lost, signal strength -64
 09-22 14:48:23 wireless,info C6:6B:0C@wifi1 connected, signal strength -62
 09-22 14:55:07 wireless,info C6:6B:0C@wifi1 disconnected, connection lost, signal strength -68
 09-22 16:47:44 wireless,info C6:6B:0C@wifi1 connected, signal strength -62
 09-22 16:52:48 wireless,info C6:6B:0C@wifi1 disconnected, connection lost, signal strength -72
 09-22 17:00:05 wireless,info C6:6B:0C@wifi1 connected, signal strength -68
 09-22 17:01:09 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -58
 09-22 17:01:10 wireless,info C6:6B:0C@wifi1 connected, signal strength -66
 09-22 17:01:36 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -71
 09-22 17:01:37 wireless,info C6:6B:0C@wifi1 connected, signal strength -67
 09-22 17:01:53 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -70
 09-22 17:01:59 wireless,info C6:6B:0C@wifi1 connected, signal strength -66
 09-22 17:45:29 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -67
 09-22 17:45:29 wireless,info C6:6B:0C@wifi1 connected, signal strength -68
 09-22 17:51:25 wireless,info C6:6B:0C@wifi1 disconnected, connection lost, signal strength -70
 09-22 19:00:20 wireless,info C6:6B:0C@wifi1 connected, signal strength -63
 09-22 19:06:08 wireless,info C6:6B:0C@wifi1 disconnected, connection lost, signal strength -85
 09-22 22:43:48 wireless,info C6:6B:0C@wifi1 connected, signal strength -52
 09-22 22:44:39 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -66
 09-22 22:44:40 wireless,info C6:6B:0C@wifi1 connected, signal strength -65
 09-22 22:45:01 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -62
 09-22 22:45:01 wireless,info C6:6B:0C@wifi1 connected, signal strength -68
 09-22 22:45:11 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -68
 09-22 22:45:12 wireless,info C6:6B:0C@wifi1 connected, signal strength -67
 09-22 22:51:14 wireless,info C6:6B:0C@wifi1 disconnected, connection lost, signal strength -78
 09-23 11:06:06 wireless,info C6:6B:0C@wifi1 connected, signal strength -70
 09-23 11:09:13 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -66
 09-23 11:09:14 wireless,info C6:6B:0C@wifi1 connected, signal strength -70
 09-23 11:12:12 wireless,info C6:6B:0C@wifi1 disconnected, group key timeout, signal strength -74
 09-23 11:14:23 wireless,info C6:6B:0C@wifi1 connected, signal strength -73
 09-23 11:21:47 wireless,info C6:6B:0C@wifi1 disconnected, connection lost, signal strength -87
 09-23 11:42:52 wireless,info C6:6B:0C@wifi1 connected, signal strength -59
 09-23 11:48:11 wireless,info C6:6B:0C@wifi1 disconnected, connection lost, signal strength -79
 09-23 15:59:09 wireless,info C6:6B:0C@wifi1 connected, signal strength -66
 09-23 16:08:07 wireless,info C6:6B:0C@wifi1 disconnected, connection lost, signal strength -74
 09-23 19:31:54 wireless,info C6:6B:0C@wifi1 connected, signal strength -60
 09-23 19:37:45 wireless,info C6:6B:0C@wifi1 disconnected, connection lost, signal strength -72
 09-23 23:46:56 wireless,info C6:6B:0C@wifi1 connected, signal strength -68
 09-23 23:51:58 wireless,info C6:6B:0C@wifi1 disconnected, connection lost, signal strength -69
 09-24 10:49:40 wireless,info C6:6B:0C@wifi1 connected, signal strength -67
 09-24 10:55:48 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -73
 09-24 10:56:45 wireless,info C6:6B:0C@wifi1 connected, signal strength -68
 09-24 11:07:30 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -73
 09-24 11:07:30 wireless,info C6:6B:0C@wifi1 connected, signal strength -74
 09-24 11:12:18 wireless,info C6:6B:0C@wifi1 disconnected, group key timeout, signal strength -72
 09-24 11:49:45 wireless,info C6:6B:0C@wifi1 connected, signal strength -70
 09-24 11:51:22 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -72
 09-24 11:51:22 wireless,info C6:6B:0C@wifi1 connected, signal strength -70
 09-24 11:52:27 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -65
 09-24 11:52:27 wireless,info C6:6B:0C@wifi1 connected, signal strength -55
 09-24 11:58:33 wireless,info C6:6B:0C@wifi1 disconnected, connection lost, signal strength -86
 09-24 12:23:19 wireless,info C6:6B:0C@wifi1 connected, signal strength -67
 09-24 12:23:54 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -69
 09-24 12:23:54 wireless,info C6:6B:0C@wifi1 connected, signal strength -71
 09-24 12:23:58 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -71
 09-24 12:23:59 wireless,info C6:6B:0C@wifi1 connected, signal strength -69
 09-24 12:26:16 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -69
 09-24 12:26:17 wireless,info C6:6B:0C@wifi1 connected, signal strength -71
 09-24 12:29:21 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -71
 09-24 12:29:22 wireless,info C6:6B:0C@wifi1 connected, signal strength -72
 09-24 12:36:25 wireless,info C6:6B:0C@wifi1 disconnected, connection lost, signal strength -70
 09-24 14:46:34 wireless,info C6:6B:0C@wifi1 connected, signal strength -57
 09-24 14:52:05 wireless,info C6:6B:0C@wifi1 disconnected, connection lost, signal strength -71
 09-24 17:37:33 wireless,info C6:6B:0C@wifi1 connected, signal strength -67
 09-24 17:37:37 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -70
 09-24 17:37:37 wireless,info C6:6B:0C@wifi1 connected, signal strength -75
 09-24 18:05:15 wireless,info C6:6B:0C@wifi1 disconnected, connection lost, signal strength -82
 09-24 18:28:54 wireless,info C6:6B:0C@wifi1 connected, signal strength -56
 09-24 18:34:35 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -72
 09-24 18:34:35 wireless,info C6:6B:0C@wifi1 connected, signal strength -74
 09-24 18:36:03 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -74
 09-24 18:36:03 wireless,info C6:6B:0C@wifi1 connected, signal strength -71
 09-24 18:40:44 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -68
 09-24 18:40:44 wireless,info C6:6B:0C@wifi1 connected, signal strength -69
 09-24 18:41:10 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -73
 09-24 18:41:10 wireless,info C6:6B:0C@wifi1 connected, signal strength -70
 09-24 18:41:13 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -69
 09-24 18:41:14 wireless,info C6:6B:0C@wifi1 connected, signal strength -71
 09-24 18:42:59 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -69
 09-24 18:42:59 wireless,info C6:6B:0C@wifi1 connected, signal strength -69
 09-24 18:45:31 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -68
 09-24 18:45:32 wireless,info C6:6B:0C@wifi1 connected, signal strength -71
 09-24 18:47:16 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -74
 09-24 18:47:17 wireless,info C6:6B:0C@wifi1 connected, signal strength -68
 09-24 18:48:03 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -76
 09-24 18:48:03 wireless,info C6:6B:0C@wifi1 connected, signal strength -72
 09-24 18:50:56 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -69
 09-24 18:50:56 wireless,info C6:6B:0C@wifi1 connected, signal strength -68
 09-24 18:57:22 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -67
 09-24 18:57:23 wireless,info C6:6B:0C@wifi1 connected, signal strength -68
 09-24 18:58:50 wireless,info C6:6B:0Cwifi1 disconnected, SA Query timeout, signal strength -69
 09-24 18:58:51 wireless,info C6:6B:0C@wifi1 connected, signal strength -69
 09-24 19:04:56 wireless,info C6:6B:0C@wifi1 disconnected, connection lost, signal strength -70
 09:20:40 wireless,info C6:6B:0C@wifi1 connected, signal strength -66
 09:23:00 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -71
 09:23:00 wireless,info C6:6B:0C@wifi1 connected, signal strength -69
 09:25:21 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -72
 09:25:21 wireless,info C6:6B:0C@wifi1 connected, signal strength -72

brg3466 · Thu Sep 28, 2023 5:17 am

anyone has solution ?

It is weird that in our house, only iPhone14 pro has this "SA query timeout" issue. All other apple devices ( macbook, macbook air, ipad or iphone 12) don't behave like this.

martinii · Mon Oct 02, 2023 4:38 pm

In my case it still doesn't work... The only solution I can see is to give my Dad a new phone.

Santi70 · Fri Nov 17, 2023 2:10 pm

I also have that problem, but only with an iPhone 13, all other devices work fine

jugernautas · Thu Dec 07, 2023 4:18 pm

Hello,
First time here. I have upgraded my cAP ax device from v7.8 to v7.12 and one "Lenovo" laptop started disconnecting often.
Looking at the log I have determined that the problem could be that laptop changes wifi frequencies from 5Ghz to 2Ghz and therefore cAP device waits until it can no longer determine that laptop is connected. After then it lets connect to AP. The duration time offline was about 1 minute.
I could not find any sophisticated information, so I tried changing these 2 values on each frequency radio interface:

connect-group ( string )

APs within the same connect group do not allow more than 1 client device with the same MAC address. This is to prevent malicious authorized users from intercepting traffic intended to other users ('MacStealer' attack) or performing a denial of service attack by spoofing the MAC address of a victim.

Handling of new connections with duplicate MAC addresses depends on the connect-priority of AP interfaces involved.

By default, all APs are assigned the same connect-group.

connect-priority (accept-priority/hold-priority (integers))

Theese parameters determine, how a connection is handled if the MAC address of the client device is the same as that of another active connection to another AP.
If (accept-priority of AP2) < (hold-priority of AP1), a connection to AP2 wil cause the client to be dropped from AP1.
If (accept-priority of AP2) = (hold-priority of AP1), a connection to AP2 will be allowed only if the MAC address can no longer be reached via AP1.
If (accept-priority of AP2) > (hold-priority of AP1), a connection to AP2 will not be accepted.

If omitted, hold-priority is the same as accept-priority.
By default, APs, which perform user authentication, have higher priority (lower integer value), than open APs.

On 2Ghz - Security - Connect Group ("Grupe2") and Connect Priority (0/1)
On 5Ghz - Security - Connect Group ("Grupe5") and Connect Priority (0/1)

For now the laptop works ok, no long disconnections from Wifi. It would be great if someone can explain if this is right way to configure it.

tinodj · Tue Jan 16, 2024 9:28 am

Hit this problem after upgrading from 6 to 7. Was very stable with 6, now on ROS7 is frustrating with this. Happens on iPhone and Mac. Happens on cAP ax and Audience. Solutions here didn’t help

Have anyone found something else?

kurio · Fri Jan 19, 2024 11:05 am

Hit this problem after upgrading from 6 to 7. Was very stable with 6, now on ROS7 is frustrating with this. Happens on iPhone and Mac. Happens on cAP ax and Audience. Solutions here didn’t help Have anyone found something else?

Hello,
Started having this problem with i don't know which version of ROS 7.xx, now running the latest 7.13.2.
Impossible to roam from independent AX2 to AX3: simple connects/disconnects, SA timeouts, no IPv4 DHCP replies, all kinds of crap.
I have tried all the suggestions here and there, but they do not work. All smartphones are android, most of them have issues staying connected when moving from floor to floor (from one hap ax to another).
However, i have noticed a workaround which works on some phones: instead of static phone MAC address switch to randomized MAS addresses.
Is this whole issue is related to the client MAC addresses?
Do i need to configure and run capsman to overcome this critical connectivity problem?

ToTheFull · Fri Jan 19, 2024 12:31 pm

CAPsMAN wont help, also the same on 7.14Beta7 maybe slightly worse than 7.14Beta6.
Anyway, I'm sure someone will be along soon to say it's your config etc...........

erlinden · Fri Jan 19, 2024 2:52 pm

Anyway, I'm sure someone will be along soon to say it's your config etc...........

How do you know his config is correct. There are not a lot of topics where, after sharing the config, there are no improvements to make on the config.

@kurio: As far as I know the client will always use the same MAC address (per SSID), even if it is randomized. No clue why you think it is helping...

In regards to the SA Query timeout problem, it has been solved for me (using CAPsMAN) by setting the connect-priority.

masseselsev · Fri Jan 19, 2024 2:54 pm

Same here on Chateau 18 (7.13.2) with all my AX diveces that are trying to connect to 2Ghz, 5Ghz connections are fine though.
No CAPsMAN, just a single(dual actually) raido.
The devices namely are a couple of Google pixel (6&7) phones, and a pair of laptops with AX211 wifis'.
Also, the devices that are not capable of AX seem to de working just fine,
And it happens randomly -- not all the devices at once.

Maybe the matter does deserve some comment from the staff?

edit. persuaded a part of the devices to connect to 5g only, now this happens both with 2 and 5 ghz (((

Fri Jan 19, 2024 2:57 pm

Then it might be better to create a ticket with supout right after you see it happening.
Because staff does not frequent these forums that often (they sometimes do).

ToTheFull · Fri Jan 19, 2024 3:56 pm

Anyway, I'm sure someone will be along soon to say it's your config etc...........

In regards to the SA Query timeout problem, it has been solved for me (using CAPsMAN) by setting the connect-priority.

Deployed... i'll let YOU Know!

2 name="wifi1" l2mtu=1560 mac-address=18:FD arp-timeout=auto radio-mac=18:FD
   configuration.mode=ap .ssid="002" .country=United Kingdom 
   security.authentication-types=wpa2-psk .encryption=ccmp .passphrase="" 
   .management-protection=allowed .wps=disable .connect-priority=0/1 
   channel.frequency=5180 .band=5ghz-ax .width=20/40/80mhz .skip-dfs-channels=10min-cac

If that isn't correct please do share what needs to be done.

fronik · Thu Feb 29, 2024 7:27 pm

Faced the same problem

disconnected, SA Query timeout

On 5Ghz - Security - Connect Priority (0/1) It worked until firmware 7.14, but on 7.14 the network on the laptop began to fall off constantly. Connected \ Disconnected...

back to 7.13.4 (and definitely System\RouterBOARD\Upgrade firmware to 7.13.4) - good work for me

Neolo · Sat Mar 02, 2024 2:18 am

Faced the same problem
Code: Select all
disconnected, SA Query timeout
On 5Ghz - Security - Connect Priority (0/1) It worked until firmware 7.14, but on 7.14 the network on the laptop began to fall off constantly. Connected \ Disconnected...

back to 7.13.4 (and definitely System\RouterBOARD\Upgrade firmware to 7.13.4) - good work for me

Priority does not do anything, 7.14. Log is flooded with SA Query timeouts. Clients have terrible experience using wifi. What is going on??

Kanzler · Sat Mar 02, 2024 7:56 am

@Neolo,
Could you please show your configuration?

fronik · Sat Mar 02, 2024 4:54 pm

RouterOS and firmware ver <= 7.13.4 - normal work
RouterOS and firmware ver = 7.14 - clients disconnected and logs: "... disconnected, SA Query timeout ..."
My config:

/interface wifi configuration

add channel.band=2ghz-ax .frequency=2412 .skip-dfs-channels=10min-cac .width=20mhz country=Russia datapath.bridge=bridge disabled=no mode=ap name=2Ghz security.authentication-types=wpa2-psk,wpa3-psk .connect-priority=0/1 .passphrase=WiFiPass124 .wps=disable ssid=WiFiName123

add channel.band=5ghz-ax .frequency=5640-5725 .skip-dfs-channels=10min-cac .width=20/40/80mhz country=Russia datapath.bridge=bridge disabled=no mode=ap name=5Ghz security.authentication-types=wpa2-psk,wpa3-psk .connect-priority=0/1 .passphrase=WiFiPass124 .wps=disable ssid=WiFiName123-5GHz

/interface wifi cap
set caps-man-addresses=127.0.0.1 enabled=yes

/interface wifi capsman
set enabled=yes package-path="" require-peer-certificate=no upgrade-policy=none

/interface wifi provisioning
add action=create-dynamic-enabled disabled=no master-configuration=2Ghz supported-bands=2ghz-ax
add action=create-dynamic-enabled disabled=no master-configuration=5Ghz supported-bands=5ghz-ax

My clients: phones, tv, ps5, smarthome devices notebooks

MaxwellsEq · Sun Mar 03, 2024 1:02 am

I didn't see any mention of disabling Frame Protection. Did this not have any effect?

Neolo · Sun Mar 03, 2024 4:37 am

@Neolo,
Could you please show your configuration?

Which configuration are you asking about?
Everything is default except for it's an open network with OWE enabled.

Neolo · Sun Mar 03, 2024 4:38 am

I didn't see any mention of disabling Frame Protection. Did this not have any effect?

The only effect it makes is rendering WPA3 and OWE inoperable. And I don't want that.

Neolo · Sun Mar 03, 2024 4:42 am

RouterOS and firmware ver <= 7.13.4 - normal work

No it wasn't. I just upgraded from 7.13.4 to 7.14, both have the same problem. Trust me, I have a public place to test with 200 people connecting, not just own laptop and a phone.

Kanzler · Sun Mar 03, 2024 7:51 am

@Neolo
Very strange, I don't experience such an issue myself. Have you tried enabling FT? Maybe that will help?

MaxwellsEq · Sun Mar 03, 2024 9:53 am

I didn't see any mention of disabling Frame Protection. Did this not have any effect?
The only effect it makes is rendering WPA3 and OWE inoperable. And I don't want that.

Lots of non-compute devices (TVs, cameras, doorbells etc.) which don't support Frame Protection also don't seem to properly ignore its presence. If you Google SA Query Timeout, you will find this also an issue with non-Mikrotik Wireless setups. We seem to have two choices, only have very modern non-compute devices (fully WPA3 compliant) or run a Wireless radio setup which has no WPA3 elements including Frame Protection (with the small security risk this implies).

ToTheFull · Sun Mar 03, 2024 10:59 am

SNIP: Trust me, I have a public place to test with 200 people connecting, not just own laptop and a phone.

From my point of view that would look painfull on the eyes.
I have tried the "Connect Priority 0/1" trick and although it seems to help (not cure) it causes unexplained speed drops on both my AX devices.

Neolo · Sun Mar 03, 2024 10:34 pm

SNIP: Trust me, I have a public place to test with 200 people connecting, not just own laptop and a phone.
From my point of view that would look painfull on the eyes.
I have tried the "Connect Priority 0/1" trick and although it seems to help (not cure) it causes unexplained speed drops on both my AX devices.

I have that priority in place, it makes zero effect, timeouts still written in log.

Neolo · Sun Mar 03, 2024 10:35 pm

@Neolo
Very strange, I don't experience such an issue myself. Have you tried enabling FT? Maybe that will help?

What's FT?

Neolo · Sun Mar 03, 2024 10:38 pm

The only effect it makes is rendering WPA3 and OWE inoperable. And I don't want that.
Lots of non-compute devices (TVs, cameras, doorbells etc.) which don't support Frame Protection also don't seem to properly ignore its presence. If you Google SA Query Timeout, you will find this also an issue with non-Mikrotik Wireless setups. We seem to have two choices, only have very modern non-compute devices (fully WPA3 compliant) or run a Wireless radio setup which has no WPA3 elements including Frame Protection (with the small security risk this implies).

Nope, in the environment I have there is no TVs or doorbells, but phones and tablets.
Mikrotik should fix the firmware to accommodate all models properly, it's all it is.

Kanzler · Sun Mar 03, 2024 10:44 pm

set ft=yes and ft-over-ds=yes in security profile to enable 802.11r fast BSS transitions (roaming)

Mon Mar 04, 2024 12:33 am

What's FT?

Fast Transitions, a recently added feature. Disabled by default. “FT” is the tab name in WinBox.

Neolo · Tue Mar 05, 2024 9:15 pm

What's FT?

Fast Transitions, a recently added feature. Disabled by default. “FT” is the tab name in WinBox.

I have enabled it in my security template, but it doesn't do anything about SA Query timeouts alone.
However, when I have connected all APs via Capsman and enabled FT and FT over DS, that seems stopped SA Query Timeout errors.

robmaltsystems · Sun Apr 07, 2024 11:32 pm

solution for me:

/interface/wifiwave2/configuration> set [find] security.connect-priority=0/1

How do you query this setting? /interface/wifi/configuration/print doesn't show anything. It doesn't appear in /export either.

ToTheFull · Sun Apr 07, 2024 11:35 pm

I think they added it to this, if thats what you mean?

interface/wifi/monitor 0,1,2,3
                 state: running        running   running        running
               channel: 5500/ax/Ceee   2412/ax   5180/ax/Ceee   2462/ax
      registered-peers: 3              0         1              2
      authorized-peers: 3              0         1              2
              tx-power: 22             14        18             15
    channel-priorities: 0:5500/ax/Ceee 0:2412/ax 0:5180/ax/Ceee 0:2462/ax

Sun Apr 07, 2024 11:46 pm

try this security settings for compatibility

security.authentication-types=wpa2-psk .disable-pmkid=yes .encryption=ccmp .group-encryption=ccmp .group-key-update=1d .passphrase=xxxxxxxxxxxx .wps=disable

PD: i dont have any ax device for testing, this config i use it on hap-ac2 and audience, with routeros 7.13.5 and 7.14.2 working ok

robmaltsystems · Mon Apr 08, 2024 12:07 am

Thanks, will do but another time - it's late in UK and I've spent more hours than I really wanted to on this.

infabo · Mon Apr 08, 2024 12:22 am

try this security settings for compatibility
Code: Select all
security.authentication-types=wpa2-psk .disable-pmkid=yes .encryption=ccmp .group-encryption=ccmp .group-key-update=1d .passphrase=xxxxxxxxxxxx .wps=disable
PD: i dont have any ax device for testing, this config i use it on hap-ac2 and audience, with routeros 7.13.5 and 7.14.2 working ok

I'll go through docs:

.encryption=ccmp .group-encryption=ccmp .group-key-update=1d

That's already the defaults.

disable-pmkid=yes

If unsure this rather lowers compatibility.

wps=disable

Sure, good idea. But I think this not increase/decrease compatibility.

robmaltsystems · Mon Apr 08, 2024 3:45 pm

I'm going to do some more reading up on this before I start making any changes.

For the record, the device I'm having trouble with is an Lenovo V15 G2-ALC laptop, Windows 10, Realtek 882CE 802.11ac wireless chip. Using WPA2/3 authentication with defaults for everything else. Not tried the FT switches yet or any other tweaks.

Connects fine with no SA Query timeout errors in the log when sat on the coffee table about 1.5m away. Move it onto the bench about 3m away and unable to connect to 5GHz with SA Query Timeout in log. There is a partial 20m stone wall in the way and often me

When 1.5m from the hAP ax2, the router reports signal strength -54. The laptop reports a signal strength of -37. That -54 is "interesting", i.e. it being so low - suggests poor signal from the laptop? Connected to timeout errors? Never had any problem with old Virgin Media router.

I bought a cheap Wi-Fi 6 USB adapter for testing purposes. Signal strengths are -44 at router and -47 on laptop. When using this, it also works fine on the bench.

The SA query time errors occur both with WPA2 and WPA3. I thought it was a WPA3 "thing" but clearly not hence the reason for wanting to read up more.

robmaltsystems · Mon Apr 08, 2024 4:39 pm

I left the laptop on the coffee table, connected to 5GHz using the Wi-Fi 6 USB network adapter and came back about an hour later and it too had got SA Query timeout errors and had fallen back to 2.4GHz:

Something isn't right here. This is sat 1.5m from the router with very little else going on. I've restarted the adapter and it's reconnected at 5GHz...

MikrotikUser100 · Tue Apr 30, 2024 3:09 pm

Hello,

We are having hard times "enjoying" our mikrotik hardware.
Despite numerous software upgrades, we are still experiencing "SA Query Timeout" on several devices in our network.
I really don't understand, this problem has been reported like a year ago, and still Mikrotik did NOTHING to help their customers. Don't you think it's kinda wrong?
We spent 500 EUR in hardware. Obviously it's my last mikrotik, but since I cannot return it anymore, I need to fix the problem.

The same client works perfectly on another wifi from another vendor. So the problem is purely in mikrotik and their software/hardware (and mine is hAP ax^3 - which is pretty expensive and at least SOHO level, not a cheap home device)

Please PROVIDE SOLUTION ASAP. I don't understand what did I pay for.

akakua · Tue Apr 30, 2024 6:37 pm

has anyone tried to set "disabled" for management protection?

robmaltsystems · Tue Apr 30, 2024 6:43 pm

I really don't understand, this problem has been reported like a year ago, and still Mikrotik did NOTHING to help their customers. Don't you think it's kinda wrong?

I tend to agree. The Lenovo laptop I mentioned above really struggles to maintain a 5G connection and it's in the same room. I'm keeping totally away from AX range in the commercial space. This is just my home/office setup.

I wonder if Mikrotik is spread too thin on the development team? I must admit the range of devices available does seem a lot. I wonder if the development team keep going to the hardware guys "STOP!!! We need to get the existing kit working first"

robmaltsystems · Tue Apr 30, 2024 6:44 pm

has anyone tried to set "disabled" for management protection?

No but I will have a go. Doesn't that reduce security?

infabo · Tue Apr 30, 2024 6:51 pm

@MikrotikUser100
Besides the log message on your mikrotik device (SAQuery timeout...): how do you experience the problem on your client device?

MikrotikUser100 · Wed May 01, 2024 2:00 pm

@MikrotikUser100
Besides the log message on your mikrotik device (SAQuery timeout...): how do you experience the problem on your client device?

It's unusable, as we use it remotly.
It's not just a log message, it's a total disconnection from the network and hence complete instability and inability to use the device.

I have tried to disable WPA3 leaving only WPA2 on my wifi interfaces with no luck, didn't help at all. And what makes it worse, is when the laptop is close to the mikrotik (like 1-2 meters) it works.

ivicask · Wed May 01, 2024 2:31 pm

@MikrotikUser100
Besides the log message on your mikrotik device (SAQuery timeout...): how do you experience the problem on your client device?
It's unusable, as we use it remotly.
It's not just a log message, it's a total disconnection from the network and hence complete instability and inability to use the device.

I have tried to disable WPA3 leaving only WPA2 on my wifi interfaces with no luck, didn't help at all. And what makes it worse, is when the laptop is close to the mikrotik (like 1-2 meters) it works.

This fixed my query errors, try set it exactly like this.

akakua · Wed May 01, 2024 2:41 pm

No but I will have a go. Doesn't that reduce security?

sa query is part of protected management frames (802.11w), so you won't get any timeouts, if it disabled:)

robmaltsystems · Thu May 02, 2024 5:06 pm

Okay, got a few minutes spare to have a look at this. Laptop is back in the location where it gets SQ query timeouts. About to disable management protection.

Got a warning but assume that's okay. Have disabled WPS as well but assume that's unconnected.

Later... hmm maybe I'll turn off WPA3 as well as I don't seem to be able to connect at 5GHz. Keeps falling back to 2.4GHz. Maybe that warning means that 5Ghz won't work?

infabo · Thu May 02, 2024 5:33 pm

Management protection is required for WPA3. So according to the red message I assume you have configured wpa2-psk/wpa3-psk mode (or even "better": wpa3-psk alone). In a "mixed" mode you need to at least set management protection to "allowed". As WPA3 requires it. And your laptop now maybe wants to connect using WPA3 and fails terribly.

robmaltsystems · Thu May 02, 2024 6:52 pm

Okay, have turned WPA3 off and switched back to just WPA2. Devices now connected at 5G except the laptop is still preferring to fall back to 2.4GHz. I suspect we may be barking up the wrong tree here and the problem with this specific Lenovo laptop is it's transmit power. This is what the laptop reports from inSSIDer:

However, this is a log entry from the hAP ax2:

00:45:E2:81:E4:61@private-5g connected, signal strength -67

So the hAP ax2 is reporting a signal from the laptop of -67 which is borderline poor.

So maybe the SA Query Timeout log entries are because the transmit power is relatively poor. I'll split the SSID into 2 and 5GHz so I can force it to try and connect to 5GHz.

Later... when SSID is different between 2.4GHz and 5GHz, laptop will connect to 5GHz quite happily and reports connection speed of 390Mbps both directions. hAP ax2 reports a signal of -65. I'll turn WPA3 back on and reset management protection.

robmaltsystems · Thu May 02, 2024 7:07 pm

A question - in terms of deciding whether to connect at 2.4GHz or 5GHz, is it the client (Windows/laptop) that decides? Or does the access point get involved?

erlinden · Fri May 03, 2024 12:08 am

It is up to the client. I tend to lower Tx Power of the 2.4GHz radio to have clients prefer 5GHz over 2.4GHz.

Turn on wireless debug logging to get more insights of the cause.

Who is online