WiFi with Apple Products

bhesterberg · Tue Apr 19, 2022 11:09 pm

So I've been having a rash of issues lately with Apple products working over wifi. Everything from Invalid County Code(802.11d) to the device connects, gets an IP but won't pull up any pages.
I've seen so many posts about Apple products and Mikrotik wifi issues. I've read them all and nothing seems to help. Is there some special rain dance or sacrifice I can make to make these damn things work with Apple products correctly? I'm using hAP AC2 on 6.48.6. I've lost 2 days on this issue and I'm about to start looking for another wifi router because of this. Everything works but Apple!!
EDIT: If you have a config for this, I'd be very interested in seeing it if you'd share it. I can't imagine what I'm doing wrong. I've went to Apple's website and did everything they suggested as far as wifi router settings.

biomesh · Tue Apr 19, 2022 11:50 pm

You are better off posting an export of your config.

bhesterberg · Wed Apr 20, 2022 12:41 am

Here's the config...

# apr/19/2022 16:38:30 by RouterOS 6.48.6
# software id = LEFF-CPFH
#
# model = RBD52G-5HacD2HnD
# serial number =
/interface bridge
add name=LAN
/interface wireless security-profiles
set [ find default=yes ] supplicant-identity=MikroTik
add authentication-types=wpa2-psk,wpa2-eap eap-methods="" group-key-update=\
15m mode=dynamic-keys name=GW supplicant-identity="" wpa-pre-shared-key=\
############ wpa2-pre-shared-key=#############
/interface wireless
set [ find default-name=wlan1 ] band=2ghz-g/n country="united states3" \
disabled=no frequency=2462 installation=indoor mode=ap-bridge \
security-profile=GW ssid="#############" wmm-support=enabled
set [ find default-name=wlan2 ] band=5ghz-a/n/ac disabled=no frequency=5240 \
mode=ap-bridge security-profile=GW ssid="############" \
wmm-support=enabled
/ip pool
add name=dhcp_pool0 ranges=10.0.0.10-10.0.0.250
/ip dhcp-server
add address-pool=dhcp_pool0 disabled=no interface=LAN lease-time=1d name=\
dhcp1
/snmp community
add addresses=::/0 name=#####
/interface bridge port
add bridge=LAN interface=ether2
add bridge=LAN interface=ether3
add bridge=LAN interface=ether4
add bridge=LAN interface=ether5
add bridge=LAN interface=wlan1
add bridge=LAN interface=wlan2
/ip neighbor discovery-settings
set discover-interface-list=!dynamic
/interface wireless access-list
add comment="Nicole's Laptop" interface=wlan2 mac-address=28:CF:E9:15:BE:03 \
vlan-mode=no-tag
/ip address
add address=10.0.0.1/24 interface=LAN network=10.0.0.0
/ip dhcp-client
add disabled=no interface=ether1
/ip dhcp-server lease
add address=10.0.0.78 client-id=1:a8:20:66:38:fa:8e comment="Work Laptop" \
mac-address=A8:20:66:38:FA:8E server=dhcp1
/ip dhcp-server network
add address=10.0.0.0/24 dns-server=10.0.0.1,1.1.1.1 gateway=10.0.0.1
/ip dns
set allow-remote-requests=yes servers=1.1.1.1,8.8.8.8
/ip firewall filter
add action=drop chain=input src-address=36.110.228.0/24
/ip firewall nat
add action=masquerade chain=srcnat out-interface=ether1 src-address=\
10.0.0.0/24
/ip service
set telnet disabled=yes
set www disabled=yes
set api disabled=yes
set api-ssl disabled=yes
/ip upnp
set enabled=yes
/ip upnp interfaces
add interface=LAN type=internal
add interface=ether1 type=external
/snmp
set contact=GW enabled=yes location=GW trap-community=GWSNMP trap-version=2
/system clock
set time-zone-name=America/Chicago
/system identity
set name="#############"
/system logging
add topics=wireless
/tool romon
set enabled=yes

mozerd · Wed Apr 20, 2022 1:05 am

I have 4 Apple Extreme WiFi Routers connected to hAP AC2 in client sites … all work well
1. Make sure that you Apple wireless Router is in bridge mode

In all my cases the Tik device has its WiFi disabled …. For WiFi strictly relying on the Apple WiFi. The reason the Extreme WiFi is far superior to the Tik WiFi. If you insist on wanting to use the WiFi built into the Tik you will need to rely on g,n and not use ac on the Apple.

If you mean Apple products like the iPhone, iMac, iPad etc then its mostly having to do with interference from other WiFi transmitters in close proximity to your Tik … in that case others will need to chime in to help you cause my Tik WiFi knowledge is very poor ….

gyropilot · Wed Apr 20, 2022 3:32 am

I've been using the WiFi on a hAP ac lite and a hAP ac successfully with Apple clients for many years. This includes countless iPhones, iPads, MacBook Pros, Apple TV's and a bunch of non-Apple devices. I don’t know if the hAP ac2 is fundamentally different.

My setup:

I use “N-only” on the 2.4G band and “N/AC” on the 5G band.

Security is wpa2-psk only.

If you don't need 802.11a, you might try getting rid of that. I suggest this because I found our older Apple TV (3rd gen I think) wouldn’t work in a “mixed mode” environment that included 802.11a, hence no “a” on my network.

Other than that, nothing else is jumping out at me while looking over your configuration.

John L.

biomesh · Wed Apr 20, 2022 6:14 am

I would disable wpa2-eap and set the group key update to at least an hour (maybe more)

Amm0 · Wed Apr 20, 2022 6:24 am

Apple recommends enable all g/n a/n/ac protocols in their docs and WMM being enabled. But I normally I set "only n" and "n/ac", but do set WMM to enabled: some iPads seem to like that being enabled (even if you don't have QoS/queues for it). Agree on removing the wpa2-eap and group key too..

A couple more things:

Use "distance=indoors" (In winbox, hit "Advance" button, then option is in Advance tab) - IMO, this is almost certainly what's causing an issue with an Apple device
Lower AMSDU limit/threshold from 8192 to 4096 (on "HT" tab) - search forum for the why, likely more important with 2.4Ghz.

rolelael · Thu Dec 01, 2022 10:09 am

I have the same issue with my ap. ios devices cant connect after entering wpa2 password. Even with the settings above... ugh. An outdoor camera connects fine though..

carlosgrillet · Sun Feb 05, 2023 4:23 am

[SOLUTION]
I have a hAP AC lite and I have conected an iPhone and an iPad. This config work for me:

on your wireles interface: set band to 5GHz-N/AC, channel width 20/40MHz eC, and enable WMM support

on your security profile: auth method WPA2-PSK only and group key update 00:55:00

my config:

/interface wireless security-profilesadd name=wifi authentication-types=wpa2-psk group-key-update=55m mode=dynamic-keys

/interface wirelessset [ find default-name=wlan2 ] band=5ghz-n/ac channel-width=20/40mhz-eC country=no_country_set default-authentication=no default-forwarding=no disabled=no frequency=auto mode=ap-bridge name=5GHz radio-name="My Zone" security-profile=wifi ssid="My Zone" wireless-protocol=802.11 wmm-support=enabled

maigonis · Mon Feb 06, 2023 12:38 am

I recommend setting group key update to 12h (tik now do 24h on latest testing).

UpRunTech · Wed Feb 08, 2023 12:33 am

Here's a list of docs from Apple on Wifi settings and trouble shooting.

https://support.apple.com/en-au/HT202068
https://support.apple.com/en-au/guide/d ... 116c0f/web
https://support.apple.com/en-au/HT203068
https://support.apple.com/en-au/HT206207

Wed Feb 08, 2023 8:53 am

We have tons of apple devices here, also in my house there are plenty, and I have never seen any of the mentioned issues.
My suspicion is this could be related to your country/region?
Also, some time ago there was an interesting bug with apple devices, that if you have another brand chinese wifi router that they were using, they somehow learned the 802.11d country code from that one, and then problems start with all other brand devices, if the 802.11d code is not there (mikrotik does not broadcast it).

anuser · Wed Feb 08, 2023 9:40 pm

Well, last week a user reported a problem. 1 cAP ac in his room, RouterOS 7.7. CAPsMAN with local forwarding, WPA2-Enterprise, EAP-TLS for the clients:

- My android 11 smartphone works
- His iPAD with firmware 16.2 works
- His Windows 10 laptop with some Intel AX2xx card works.
- His iPhone 14 iwth firmware 16.2 is connected but doesn´t receive any IP address.

Test SSID with WPA2 PSK with the same VLAN settings: His iPhone connects and receives an IP. Back to the first SSID with WPA2 Enterprise + EAP-TLS: iPhone is connected but doesn´t receive any IP.
All hints by Apple (resets, reboots, ...) don´t help...

gotsprings · Sat Feb 11, 2023 2:54 am

Got a call from a customer tonight.

"We are back in town and wireless works... but our iphones and ipads won't connect."

I think they have been away for over a year...

They are one of my installs that still has cAP AC. 5 of them and one of them is running as the caps-man BUT with local forwarding on.

Updated them from some 6.x branch to 7.7

"Our stuff connects now... thanks."

Lets see how long that lasts.

dwnldr · Sat Aug 26, 2023 10:42 am

Dear community !

Since my troubles are also related to Apple products, i try to ask here instead of creating new topic.

I would like to kindly ask you for help, since i have serious problems after upgrading from "hap ac3 / generic WiFi" to "hap ax3 /wifiwave2" and my Apple devices. It looks like some energy/powersavings kicks in on end devices, and the results are missed WiFi calls and not working smarthome automations based on presence (presence measured-automated by WiFi connection of our phones). Im posting my configuration and also screenshots of smarthome presence history, also comparison to an Android phone (which works great). Im using those smarthome automations and WiFi calling (because of poor GSM) for years, and with generic driver on hap ac3 worked everything without problems. Have still some "ac" MikroTik devices in garden, also everything works as should. I found lot of informations from the past, set beacon, etc..., but the issue is still there.

Can you please help me, what else can i do ?

Thank you very much !

# model = C53UiG+5HPaxD2HPaxD
# serial number = 
/interface wifiwave2
set [ find default-name=wifi1 ] channel.frequency=5180 .skip-dfs-channels=all \
    .width=20/40/80mhz configuration.dtim-period=3 .mode=ap .ssid=\
    "MikroTik WiFi" disabled=no mtu=1500
set [ find default-name=wifi2 ] channel.frequency=2412 .skip-dfs-channels=all \
    .width=20/40mhz-Ce configuration.dtim-period=3 .mode=ap .ssid=\
    "MikroTik WiFi" disabled=no mtu=1500

sid5632 · Sat Aug 26, 2023 12:17 pm

what else can i do ?

Stop posting massive screenshots.

erlinden · Sat Aug 26, 2023 12:20 pm

Can you please help me, what else can i do ?

Using 40MHz on the 2.4GHz band is crap (unless...etc.). Set it to 20MHz.

Can you share your config on your previous device as well? Then we have something to compare.

dwnldr · Sat Aug 26, 2023 6:03 pm

what else can i do ?
Stop posting massive screenshots.

Wear eyeglasses, stop looking on them or buy a monitor with higher resolution...damn

dwnldr · Sat Aug 26, 2023 6:08 pm

Can you please help me, what else can i do ?
Using 40MHz on the 2.4GHz band is crap (unless...etc.). Set it to 20MHz.

Can you share your config on your previous device as well? Then we have something to compare.

Thank you very much for your reply. Sadly, the old device was reset and reused in different location. The setup was quite the same, of course as much generic driver and wifiwave2 settings could be the same. The reason of 40Mhz on 2.4Ghz is, that im apartment, without any WiFi networks around, so why not benefit from 40mhz in such a setup. But i made already try to set only 20Mhz, but the story is the same :/ I have really no clue how to avoid the disconnecting under "sleep"

mkx · Sat Aug 26, 2023 6:15 pm

Stop posting massive screenshots.
Wear eyeglasses, stop looking on them or buy a monitor with higher resolution...damn

@dwndlr you're here asking for help, so you'll have to play nicely. And posting huge screenshots is not nice (I'm often using a tab to read this forum and post (hopefully useful) replies and I'm not going to start using a huge tab just to please you).

Since you're using dual-band AP, I'm guessing you are using 2.4GHz band (among others) to maximize coverage (you get the performance on 5GHz band). If that's the case, the using only 20MHz channel will give you 3dB better signal strength, hence slightly bigger coverage.

There are many ways to determine that certain wireless client id not connected any more and since you didn't post full config (and actual log vontent from AP/router) it's not possible to say what needs to be changed.

dwnldr · Sat Aug 26, 2023 6:49 pm

@mkx - Thank you for your reply. Exactly this is how i expect to behave and reply, if somebody made a mistake or need help. I do the same, in same way... Ive posted the pictures as attachments immediately after screenshots was made to provide as much informations as i can. Ill make next time pictures smaller, in case of posting them. Apologize for that

The case is, that generic driver on hap ac3 worked without issues, with "same" config. If i made try with wifiwave2 i had to revert back, also because of this issue. Since ax3 uses only new driver, i have no choice, and really no clue what else can i do. The phone behaves like described also if its lying locked 2meters on the table from router, so ill think it is not about signal strenght or not connecting. I have signal fair enough, and the devices connecting to network immediately you wake them up (phone, tablets etc...) but during "locked" status, they are randomly disconnected, i have missed WiFi calls, and as you see, my smarthome system (with mikrotik integration) is capturing phone state as "away", while the android phone is "home" all the time (see on huge screenshots...). The away status appears 180seconds after disconnecting from WiFi, so roaming between 2.4 and 5ghz also doesnt make problems. But as you see, we are talking about hours off, especially during night when you dont use your phone

mkx · Sat Aug 26, 2023 9:21 pm

Again: is there anything in logs about the "disappearing" wireless clients? Both on AP (wireless disconnect messages, etc.) and from DHCP server (any problems with renewing leases?).

At the end of the day, if client decides to stop communicating with AP - e.g. when going into some sleep mode - then there isn't much for AP to do about it. Well, there might be some ax features about sleep modes that wifiwave2 driver doesn't implement (which would explain the difference in behaviour of same Apple device when connecting to AP running legacy driver vs. running wifiwave2 driver), but that's extremely hard to diagnose without having proper tools (which we, ordinary users, don't have). But again, there might be something in the logs, but so far you didn't show any.

Kanzler · Sat Aug 26, 2023 9:31 pm

Just over a year ago, I had the same issue. In my case, the following helped: I set the lease time value to 1 day in the DHCP server settings.

ToTheFull · Sat Aug 26, 2023 9:33 pm

You can filter by MAC where XX:XX is to make life easy

/log print where message~"XX:XX"

dwnldr · Sun Aug 27, 2023 12:24 am

@mkx - Thank you. Ill provided informations in a way, which was known for me. Now with help of @ToTheFull i exported log for specific mac address... It is for sure "something" in/with wifiwave2, since as i mentioned with same device - same client - but old driver this was not happening, and im sure im not the only one.

@Kanzler - Thanks for your reply, however this - setting up longer DHCP lease time and static IPs is one of the first thing i do on fresh config. So this is already done :/

@ToTHeFull - Thank you very much for your assistance. With your hint, i was able to export the log for the device... Sadly for me, it doesnt tells anything usefull...

Short cutout from log...

 18:04:15 wireless,info A4:C3:37:17:E1:B2@wifi1 connected, signal strength -66
 18:25:15 wireless,info A4:C3:37:17:E1:B2@wifi1 disconnected, connection lost, sig
nal strength -60
 18:30:52 wireless,info A4:C3:37:17:E1:B2@wifi1 connected, signal strength -61
 18:48:31 wireless,info A4:C3:37:17:E1:B2@wifi1 disconnected, connection lost, sig
nal strength -59
 18:48:46 wireless,info A4:C3:37:17:E1:B2@wifi1 connected, signal strength -58
 18:53:42 wireless,info A4:C3:37:17:E1:B2@wifi1 disconnected, connection lost, sig
nal strength -60
 18:54:49 wireless,info A4:C3:37:17:E1:B2@wifi1 connected, signal strength -62
 19:00:23 wireless,info A4:C3:37:17:E1:B2@wifi1 disconnected, connection lost, sig
nal strength -60
 19:00:32 wireless,info A4:C3:37:17:E1:B2@wifi1 connected, signal strength -61
 19:06:19 wireless,info A4:C3:37:17:E1:B2@wifi1 disconnected, connection lost, sig
nal strength -60
 19:07:25 wireless,info A4:C3:37:17:E1:B2@wifi1 connected, signal strength -62
 19:12:31 wireless,info A4:C3:37:17:E1:B2@wifi1 disconnected, connection lost, sig
nal strength -61
 19:12:49 wireless,info A4:C3:37:17:E1:B2@wifi1 connected, signal strength -62
 19:18:03 wireless,info A4:C3:37:17:E1:B2@wifi1 disconnected, connection lost, signal strenght -63

DarkNate · Sun Aug 27, 2023 2:40 am

Are people still going on about this? Your config export clearly shows you failed to configure the “country” for both bands. Configure the country for both bands to the actual country you bought the iPhones from, reboot the AP.

dwnldr · Sun Aug 27, 2023 10:39 am

@DarkNate - Thank you for your reply. I didnt failed, i made that by purpose. Wifiwave2 documentation clearly shows, that default value is United States, even when country is not set. Since i live in apartment without any wifi, people/objects in neighborhood, i really dont care about bit higher throughput, which default country settings/usa offers compared to settings of Slovakia. The channels are set, and the devices are connected and working till you "lock" them. I cannot imagine how can this settings change the current issue, what country should i set if i bought 2devices from different country, and why with generic driver worked everything without country set (no_country_set)... This is strange! But i changed my country config as you proposed. What is immediately visible, that 5m from router my phone loses connection for a second and rejoin again (probably because lower antenna gain, transmit power...). I will test this config now.

Thank you once again !

Sun Aug 27, 2023 10:48 am

Some channels are avoided in the USA: https://en.wikipedia.org/wiki/List_of_WLAN_channels
Ce, Ce, Ceee could have different settings ... it's not so obvious as it looks like.

dwnldr · Sun Aug 27, 2023 11:06 am

@BartoszP - Thank you for your reaction. Yes, im familiar with those changes, but since i have fixed channel "1" and "36", which are both standard, allowed channels, skipped DFS etc, i thought it should not affect anything. Also as i mentioned, everything works till some powersave kicks in. Im testing right now how the devices behave with new country settings. No matter what ive done, Android phone works everytime as should :/

erlinden · Sun Aug 27, 2023 11:20 am

Country code is for legislation purposes and probably something more. It is used to select the country you are in. Just to make sure...

Is it limited to one device? Have you tried resetting Wifi or even the complete phone? And, perhaps better, removed and afterwards added the Wifi network on this Apple device?

Can you share the complete wireless settings?

mkx · Sun Aug 27, 2023 11:40 am

Sometimes WiFi clients insist on some weird default behaviour if their location can't be determined. My own experience from quite a few years ago: I like to run my APs on channel 13 (I'm from ETSI country so it's legal ...) and my better half got a new phone - LG G4. I wanted to do as much configuration as possible before switching SIM card from her old phone ... so I started configuring new phone without it ever seeing SIM card. But the new phone simply didn't detect WiFi network no matter what I tried. After I inserted SIM card, phone registered to mobile network ... and detected WiFi AP.

While the apparent settings by @dwndlr don't point in the same direction, it could be something else "funny" going behind the scenes. And I'm pretty sure that it's more Apple doing than MT doing, both your experience and MMT logs show that connectikn is lost due to Apple device going to power save mode which prevents it from communicating with wireless network. Which might be due to settings ... e.g. could it be that settings on AP don't allow using basic rates with lowest rates (which require lowest power)?

ToTheFull · Sun Aug 27, 2023 12:03 pm

Just to add my two pence worth here about 1 apple device I have, I now only run WPA2 because it's a WPA2 only device, and also only allow that device to connect to my 5G AP's as it seems to want to have a fight when the device is allowed to choose between 2.4 and 5G WiFi. It does silly things like @dwndlr is describing. Now I only allow said device onto my 5G AP's the problem has calmed down. Is that correct? maybe not, but it is what it is.
As mkx says, strange things happen!

Amm0 · Sun Aug 27, 2023 4:02 pm

Configure the country for both bands to the actual country you bought the iPhones from, reboot the AP.

Agree, this should be set it explicitly IMO. I would not relay on the default for country to be right. Whether this is cause of issue or not, it's a good idea.

Also, Apple has the AirPort Utility app. While this was designed to manage older Apple AirPort Wi-Fi router, it critically has a Wi-Fi scanner that works with any AP, including Mikrotik.
See: https://apps.apple.com/us/app/airport-u ... d427276530
You'll be able to see the various RSSI your phone it reading — since that's what's deciding the band/AP to use.

This Apple article describes the selection logic: https://support.apple.com/en-us/HT203068

ToTheFull · Sun Aug 27, 2023 5:52 pm

Bit more info here about the Auto join process as well.
https://support.apple.com/en-gb/102169

dwnldr · Sun Aug 27, 2023 6:06 pm

Thank you very much guys for lot of assistance ! Im speechless, how much support i get. Thank you once again !

I can export-show whatever config is needed to get some solution, just please let me know what and how. Im not a big friend with linux terminal.

Of course im not telling this is MT fault, im just sharing the issue and again the fact, that i didnt had and have any troubles with generic driver on hap ac3, while wifiwave makes this problems on hap ac3 and ax3 also. We have two phones, both iPhones are randomly diaconnected during sleep. I have some older iPads too, i can check how they behave. Security is set to WPA2 only, because if i set WPA2 and WPA3 auth type, the mentioned older iPads are not able to connect to network. Maybe issue is caused by WMM or Multicast helper, which could not be adjusted in wifiwave. No idea so far, but sadly those issues are not acceptable for me. We are missing wifi phone calls (we have sadly very low gsm signal here) and whole our home automation based on presence is destroyed. Country set, dhcp lease time set to 24hours, auth WPA2, fixed 2.4 and 5Ghz channels, Android works totally fine.

ToTheFull · Sun Aug 27, 2023 6:42 pm

(/log print where message~"46:3D")
08-22 07:28:59 wireless,info 46:3D@wifi1 connected, signal strength -82
08-22 07:28:59 dhcp,info defconf deassigned 192.168.0.100 for 46:3D
08-22 07:29:00 dhcp,info defconf assigned 192.168.0.100 for 46:3D
08-23 07:07:08 wireless,info 46:3D@wifi1 disconnected, SA Query timeout, signal strength -56
08-23 07:08:31 wireless,info 46:3D@wifi1 connected, signal strength -50
08-23 07:08:31 dhcp,info defconf deassigned 192.168.0.100 for 46:3D
08-23 07:08:32 dhcp,info defconf assigned 192.168.0.100 for 46:3D
08-23 19:18:44 wireless,info 46:3D@wifi1 disconnected, connection lost, signal strength -49
08-23 21:48:08 wireless,info 46:3D@wifi1 connected, signal strength -49
08-23 21:48:08 dhcp,info defconf deassigned 192.168.0.100 for 46:3D
08-23 21:48:09 dhcp,info defconf assigned 192.168.0.100 for 46:3D
08-24 08:06:13 wireless,info 46:3D@wifi1 disconnected, connection lost, signal strength -67
08-24 10:22:04 wireless,info 46:3D@wifi1 connected, signal strength -68
08-24 10:22:04 dhcp,info defconf deassigned 192.168.0.100 for 46:3D
08-24 10:22:05 dhcp,info defconf assigned 192.168.0.100 for 46:3D
08-24 16:10:31 wireless,info 46:3D@wifi1 disconnected, connection lost, signal strength -52
08-24 16:10:54 wireless,info 46:3D@wifi1 connected, signal strength -52
08-24 22:04:20 wireless,info 46:3D@wifi1 disconnected, connection lost, signal strength -45
08-24 22:04:24 wireless,info 46:3D@wifi1 connected, signal strength -47
08-25 02:35:20 wireless,info 46:3D@wifi1 disconnected, connection lost, signal strength -56
08-25 02:35:30 wireless,info 46:3D@wifi1 connected, signal strength -57
08-25 10:47:59 wireless,info 46:3D@wifi1 disconnected, SA Query timeout, signal strength -47
08-25 10:50:21 wireless,info 46:3D@wifi1 connected, signal strength -48
08-25 18:29:39 wireless,info 46:3D@wifi1 disconnected, SA Query timeout, signal strength -49
08-25 20:13:42 wireless,info 46:3D@wifi1 connected, signal strength -50
08-25 20:13:43 dhcp,info defconf deassigned 192.168.0.100 for 46:3D
08-25 20:13:44 dhcp,info defconf assigned 192.168.0.100 for 46:3D
08-25 21:56:20 wireless,info 46:3D@wifi1 disconnected, SA Query timeout, signal strength -53
08-25 23:01:33 wireless,info 46:3D@wifi1 connected, signal strength -66
08-25 23:01:34 dhcp,info defconf deassigned 192.168.0.100 for 46:3D
08-25 23:01:35 dhcp,info defconf assigned 192.168.0.100 for 46:3D
08-25 23:37:15 wireless,info 46:3D@wifi1 disconnected, connection lost, signal strength -49
08-25 23:37:28 wireless,info 46:3D@wifi1 connected, signal strength -50
08-26 03:48:16 wireless,info 46:3D@wifi1 disconnected, connection lost, signal strength -49
08-26 03:48:21 wireless,info 46:3D@wifi1 connected, signal strength -50
08-26 04:23:56 wireless,info 46:3D@wifi1 disconnected, connection lost, signal strength -49
08-26 04:24:02 wireless,info 46:3D@wifi1 connected, signal strength -49
08-26 04:27:50 wireless,info 46:3D@wifi1 disconnected, SA Query timeout, signal strength -49
=========I pressed Forget 2.4g network connection on the Ipad Air2 at this point==============
08-26 09:54:14 wireless,info 46:3D@wifi1 connected, signal strength -50
08-26 09:54:15 dhcp,info defconf deassigned 192.168.0.100 for 46:3D
08-26 09:54:16 dhcp,info defconf assigned 192.168.0.100 for 46:3D

(interface/wifiwave2/registration-table/print detail stats)
A interface=wifi1 ssid="5G" mac-address=46:3D uptime=1d6h38m23s signal=-50
tx-rate=866.7Mbps rx-rate=866.7Mbps packets=1681841,666640 bytes=2140793508,112253255
tx-bits-per-second=0bps rx-bits-per-second=0bps

Mine after just forgetting 2.4G, it's a work around that works for me. Keeps the thing connected!
Your problem may differ, I hope you can get it more stable with the Help that has been provided here.
Best of Luck!

dwnldr · Sun Aug 27, 2023 7:04 pm

@ToTheFull - thanks mate ! I have one more day to send back the device, so ill have to find some solution, otherwise i would be forced to change to something else. I would like to avoid this, since i have 8 MT devices running at home, garden, office. I really dont want to swap from this ecosystem. Lets see...

Amm0 · Sun Aug 27, 2023 7:18 pm

Of course im not telling this is MT fault, [...] Country set, dhcp lease time set to 24hours, auth WPA2, fixed 2.4 and 5Ghz channels, Android works totally fine.

You may want to try the "testing" version v7.12beta and see if that helps. The "SA Query" timeout log messages seems odd, but IDK. This sounds similar to: viewtopic.php?p=1019970

dwnldr · Sun Aug 27, 2023 9:06 pm

@Amm0, thank you for your reply !.. but, i send back the device.

In last 2hours was my phone again twice detected as "away" by my SmartHome server, and i got message from carrier about missed phone call since i was unreachable. Ordered RB4011iGS+5HacQ2HnD-IN. It looks like as the device with fastest WiFi5, able to work with old generic drivers, with solid HW/cpu. Im tired of test/fail procedures the whole week and weekend. Im also working from home, i have to be reachable. At least, i hope i made good decision with 4011+WiFi. I didnt want to revert back to hap ac3 (since is used in other location after i replaced it).

Thank you very much once again everybody for support ! Happy end postponed...

eleroy · Wed Sep 13, 2023 1:46 am

In my case, I had an ipad Mini not wanting to connect, and deactivating WPA3 did the trick.

Wed Sep 13, 2023 2:11 pm

Such beahaviour is not only Mikroitk problem. I have Ruckus WiFi networks and after upgrade of no-problems-for-many-years setups and WPA2+WPA3 authentication activation things went WRONG for many devices. WPA2 only cured situation

Adriahno · Thu Sep 14, 2023 8:44 pm

Just to add my two pence worth here about 1 apple device I have, I now only run WPA2 because it's a WPA2 only device, and also only allow that device to connect to my 5G AP's as it seems to want to have a fight when the device is allowed to choose between 2.4 and 5G WiFi. It does silly things like @dwndlr is describing. Now I only allow said device onto my 5G AP's the problem has calmed down. Is that correct? maybe not, but it is what it is.
As mkx says, strange things happen!

How do you force the device to join only 5G band?

memelchenkov · Fri Sep 15, 2023 1:49 am

How do you force the device to join only 5G band?

There are two ways:
1. Separate network names for 2.4 Ghz and 5 Ghz networks .
2. When the same name, use "Access List" tab of Wireless, add necessary MAC addresses, select 2.4 Ghz interface and uncheck "Authentication" and "Forwarding" checkboxes. — that will disallow to connect to 2.4 Ghz network so selected devices will connect to 5 Ghz only.

peri · Fri Sep 15, 2023 12:01 pm

I'm having the same problem. For details, see this thread:
viewtopic.php?p=1018900#p1018900

andyhenckel · Wed Sep 20, 2023 5:55 pm

I found 2 things to fix.

Change Preamble mode from both to Long
switch channel to 20 mHz since some I things don't support it.

guinnessMD · Fri Dec 01, 2023 4:29 pm

I use “N-only” on the 2.4G band and “N/AC” on the 5G band.

Hi there... how to set it up via Winbox please? Thanks a lot!

Fri Dec 01, 2023 6:19 pm

Apple devices will always choose 5GHz bands, unless the signal gets unusably bad.

gyropilot · Fri Dec 01, 2023 6:20 pm

Hi there... how to set it up via Winbox please? Thanks a lot!

Launch Winbox.

Click "Wireless" in menu...

screenshot_1110.jpg

In the Wireless window that opens, click the "WiFi Interfaces" tab then click on each band (one at a time) to open its Interface screen...

screenshot_1111.jpg

On the "Wireless" tab of the Interface screen, use the pulldown menu to choose the band and protocol...

screenshot_1114.jpg

screenshot_1113.jpg

Regards,

John L.

jonmansey · Sat Dec 02, 2023 11:34 pm

I just added an ax3 and upgraded my cAP-ACs to the qcom-ac driver and 13rc2. I have an old iPad Mini2 on my desk with security cameras displayed on it, and wifi was working just fine on it after I got done with the upgrades, and everything else was working too. Some time later in the day I noticed it had kicked off the wifi and when I went to reconnect, it was saying incorrect password. I made a special ssid for it on a 2g radio of a nearby AP, and found I needed to disable wpa3 (not unexpectedly) keeping just wpa2, and also disable management protection in order for the iPad Mini2 to be able to connect.

guinnessMD · Mon Dec 04, 2023 10:08 am

Thanks a lot JhonL. for those posts... but it didn't work for me... my MacBook 12 disconnects after a minute or so... and after that, I have to switch wifi on it off and on to be able to get it working on the laptop (after dropping the connection with mikrotik, my macbook won't see any wifi network).

jonmansey · Tue Dec 05, 2023 9:20 am

Interesting finding that might be of use to someone. This might belong under the 7.13rc2 thread as a bug, or it may be a feature of the new wifi stuff. Bear with me, its a bit long-winded to explain.

A new MacBook Air M2 was unable to pull a dhcp lease all day. It was connecting to wifi and roaming just fine, both ac and ax APs, 2g and 5g, just no L2 connectivity to the gateway router that hosts dhcp, so it reports "no internet connectivity" with the ! wifi symbol. All other devices are fine, many other Apple products of multiple generations, a lot of TVs and IoT stuff, no issues. My wifi is currently a hybrid of AX (qcom) and AC (qcom-ac) with capsman2 and a single vlan. I "static hardwired" the vlan on the bridges of the AC devices, and removed the datapath from the capsman config for them. The capsman config for the ax device has the bridge and vlan set in the datapath and it is successful in creating the vlan in the bridge on the ax. This all works.

In order to populate the comment field in the wifi registration table, I use a script to copy the dhcp hostname to the wifi access-list comment field for each device connected. So the access-list has all the device's mac addresses with a comment as the hostname, no other fields set, with action=accept. As I said, all other devices, this works great. Just this MacBook Air M2 was unable to pull a dhcp address all day, and I started noticing the interfaces in the wifi wifi tab, the ac radios showed a message in red "client was disconnected because could not assign vlan". Odd, I thought, because the ac configuration has no datapath set which would be trying to set the vlan. The ax radios did not have this message.

So it turns out, if you have an access-list with nothing set other than a mac, comment and action=accept, seems it is still trying to "set the vlan" on the AP it connects to. Even with the vlan field left blank. The AC APs, as we know, are unable to set a vlan dynamically. Even with vlan field blank, it's trying to set the vlan on the AP to ..."something". But apparently only for the wifi client in the M2 Air (running the latest Sonoma).

So the work-around for this for now is to not have any entry in the access-list for this particular MBP Air M2 machine's mac. So I get a device with no hostname-populated comment in the wifi registration table.

My best guess is the wifi client in the M2 radio is somehow triggering the AP to assign a vlan from the acl entry, where other wifi clients do not. This must be specific to the MBP M2 chipset (and likely other recent Mac models), as I have other Sonoma M1s and latest Apple silicon iPads that have no such issue. Weird but true.

Tue Dec 05, 2023 9:23 am

When a device says incorrect password, it may be that you changed your encryption settings. Did you enable or disable WPA2 or WPA3? Then forget this device from your iPad and connect to it anew.

nonolk · Tue Dec 05, 2023 9:32 am

@Normis, could you pleas ahve a look to this SUP-113114, it's totally related to this issue (ipad Air 2 unable to connect once FT is activated, with just bad password), and I have no news from support since July 11th

Thank you

whatever · Tue Dec 05, 2023 9:34 am

I started noticing the interfaces in the wifi wifi tab, the ac radios showed a message in red "client was disconnected because could not assign vlan". Odd, I thought, because the ac configuration has no datapath set which would be trying to set the vlan. The ax radios did not have this message.

Do you have FT enabled? There is a pretty recent setting to keep the assigned vlan id when roaming via FT and it defaults to yes. I can imagine this breaks your setup when a device attempts to carry over its vlan tag to an AC device.

Tl;dr: Try to disable FT. If it works with FT disabled, check behavior with ft-preserve-vlanid=no or use the same (untagged) datapath everywhere, including AX devices

ToTheFull · Tue Dec 05, 2023 11:02 am

@Normis, could you pleas ahve a look to this SUP-113114, it's totally related to this issue (ipad Air 2 unable to connect once FT is activated, with just bad password), and I have no news from support since July 11th

Thank you

When a device says incorrect password, it may be that you changed your encryption settings. Did you enable or disable WPA2 or WPA3? Then forget this device from your iPad and connect to it anew.

I have the same issue with ipad air 2, Just make a seperate SSID for devices that don't know what FT is, use wpa2,ccmp,FT disabled 7.13RC2.

nonolk · Tue Dec 05, 2023 11:58 am

@ToTheFull yes this is what I did, but as far as I can see the Ipad Air 2 should be able to "understand FT" look here:https://support.apple.com/en-us/103274

Since Ipad AIr 802.11 K and r are supported

ToTheFull · Tue Dec 05, 2023 12:25 pm

Either way, it doesn't work with FT Enabled!

Edit: And my Wife refuses to upgrade while security updates are available.

Tue Dec 05, 2023 12:52 pm

I doubt that FT itself is the problem. It could be that your wifi1 and wifi2 have different security settings, so when iPad goes from one to the other, settings don't match and it fails.

ToTheFull · Tue Dec 05, 2023 1:53 pm

You can check to see if you see anything, I've just spent a good while editing out MACS, this will be my last word on this.

/interface/wifi/actual-configuration/print

0 name="cap-wifi1" mac-address=48:A9 arp-timeout=auto radio-mac=48:A9
configuration.mode=ap .ssid="01" .country=United Kingdom
security.authentication-types=wpa2-psk,wpa3-psk .encryption=ccmp .passphrase="1234"
.management-protection=allowed .wps=disable .ft=yes .ft-over-ds=yes
channel.frequency=5500 .band=5ghz-ax .width=20/40/80mhz .skip-dfs-channels=10min-cac

1 name="cap-wifi2" mac-address=48:A9 arp-timeout=auto radio-mac=48:A9
configuration.mode=ap .ssid="01" .country=United Kingdom
security.authentication-types=wpa2-psk,wpa3-psk .encryption=ccmp .passphrase="1234"
.management-protection=allowed .wps=disable .ft=yes .ft-over-ds=yes
channel.frequency=2412 .band=2ghz-ax .width=20mhz .skip-dfs-channels=10min-cac

2 name="wifi1" l2mtu=1560 mac-address=18:FD arp-timeout=auto radio-mac=18:FD
configuration.mode=ap .ssid="02" .country=United Kingdom
security.authentication-types=wpa2-psk,wpa3-psk .encryption=ccmp .passphrase="4321"
.management-protection=allowed .wps=disable
channel.frequency=5180 .band=5ghz-ax .width=20/40/80mhz .skip-dfs-channels=10min-cac

3 name="wifi2" l2mtu=1560 mac-address=18:FD arp-timeout=auto radio-mac=18:FD
configuration.mode=ap .ssid="01" .country=United Kingdom
security.authentication-types=wpa2-psk,wpa3-psk .encryption=ccmp .passphrase="1234"
.management-protection=allowed .wps=disable .ft=yes .ft-over-ds=yes
channel.frequency=2462 .band=2ghz-ax .width=20mhz .skip-dfs-channels=10min-cac

Disconnecting from wifi1 then trying to connect to the other 3 radios with FT enabled

11:19:27 wireless,info 7E:40@wifi1 disconnected, connection lost, signal strength -57
11:19:27 wireless,info debug: 7E:40@wifi1 disconnected, connection lost, signal strength -57
11:19:27 wireless,debug debug: 7E:40@wifi1 disassociated, connection lost, signal strength -57
11:19:27 wireless,debug debug: 82:28@cap-wifi2 associated, signal strength -76
11:19:27 wireless,debug debug: 82:28@cap-wifi2 disassociated, connection lost, signal strength -71
11:20:55 wireless,debug debug: 82:28@cap-wifi1 associated, signal strength -76
11:21:01 wireless,debug debug: 82:28@cap-wifi1 disassociated, key handshake timeout, signal strength -80
11:21:17 wireless,debug debug: 82:28@cap-wifi1 associated, signal strength -76
11:21:23 wireless,debug debug: 82:28@cap-wifi1 disassociated, connection lost, signal strength -79
11:21:23 wireless,debug debug: 82:28@cap-wifi1 associated, signal strength -80
11:21:29 wireless,debug debug: 82:28@cap-wifi1 disassociated, key handshake timeout, signal strength -82
11:21:40 wireless,debug debug: 82:28@wifi2 associated, signal strength -64
11:21:40 wireless,debug debug: 82:28@wifi2 disassociated, connection lost, signal strength -64
11:22:11 wireless,debug debug: 7E:40@wifi1 associated, signal strength -64
11:22:11 wireless,info 7E:40@wifi1 connected, signal strength -64
11:22:11 wireless,info debug: 7E:40@wifi1 connected, signal strength -64

This is me rebooting the router After disabling FT via sec1 for the other3 radios no other changes,
you can now see the device connects!

11:35:56 system,critical,info cloud change time Dec/05/2023 11:35:33 => Dec/05/2023 11:35:56
11:36:21 wireless,debug debug: 7E:40@wifi1 associated, signal strength -51
11:36:21 wireless,info 7E:40@wifi1 connected, signal strength -51
11:36:21 wireless,info debug: 7E:40@wifi1 connected, signal strength -51
11:36:40 wireless,info 7E:40@wifi1 disconnected, connection lost, signal strength -54
11:36:40 wireless,info debug: 7E:40@wifi1 disconnected, connection lost, signal strength -54
11:36:40 wireless,debug debug: 7E:40@wifi1 disassociated, connection lost, signal strength -54
11:36:40 wireless,debug debug: 82:28@wifi2 associated, signal strength -61
11:36:40 wireless,info 82:28@wifi2 connected, signal strength -61
11:36:40 wireless,info debug: 82:28@wifi2 connected, signal strength -61
11:36:42 dhcp,info defconf assigned 192.168.0.101 for 82:28

gotsprings · Tue Dec 05, 2023 2:28 pm

When a device says incorrect password, it may be that you changed your encryption settings. Did you enable or disable WPA2 or WPA3? Then forget this device from your iPad and connect to it anew.

Apple products will say incorrect password when they fail to get a DHCP address.

It's not useful diagnostically to look at the device error.

Amm0 · Tue Dec 05, 2023 3:14 pm

It's not useful diagnostically to look at the device error.

True. But on Mac, you can hold "Option" key while clicking on the Wi-Fi icon & additional "debug" information will show in the Wi-Fi list. Now that won't help with WPA2/etc not being set, but generally useful to see what band/AP/signal/etc it connects.

nonolk · Tue Dec 05, 2023 3:28 pm

@Normis, with all due respect, I completly confirm what @ToTheFull says, just deactivating FT solve the issue instantly

As requested by @Guntis, I will upgrade to 7.13rc2 and provide the requested supout

I'm just not at home today, but I will be tomorow.

Best regards,

jonmansey · Tue Dec 05, 2023 7:27 pm

Confirming iPad mini 2 and iPad Air work fine with WPA3, WPA2 and management frames enabled, but ft disabled.

So despite that Apple article, seems something isn't quite happy with FT on this generation of device running version 12.5.7.

jonmansey · Wed Dec 06, 2023 4:21 am

@whatever thanks for this tip! Confirming ft-preserve-vlanid=no fixes the issue I described in post_id=1040082 with no other apparent ill effects.

Maybe it should default to no in non-RADIUS setups.

cli only.

/int wifi security set 0 ft-preserve-vlanid=no

tomazz · Wed Dec 06, 2023 8:03 pm

A tik newbie here.
We have numerous Apple devices (older and newer) at home and _all_ were having issues with hapac2 wireless. The worst was iPhone/IOS that would spontaneously reboot several times daily even when phone was _not_ is use. Macs would keep dropping wireless connection too frequently to be of any use. PCs and Android worked OK. Linux also OK. All devices were fully updated.

After setting configuration as shown below I managed to prevent iPhone reboots and Macs seem to work OK. Or at least the phenomena was drastically reduced.
The tik was used in AP mode:
- set group key update to 1h
- (crucially !!!) disable IPV6
- set wireless to N & AC only
- turned off 2.4GHz in order to
- avoid interference, retransmissions (=poor reliability and data rate) due to many (30+) detected networks in this band
- reduce power consumption & heating
- non related to apple issue) kill interference with some other devices in the house
- put some distancers on the box bottom to improve air circulation around the box as it gets really hot
- set all other parameters, as suggested here: WPA2 + AES, ...

I did not investigate this further as it works for me now to the extend I need, at least I hope so. If someone wants to dig further into this I am willing to support with logging and similar, but I don't have time to nail this down to the source. It could well be that this solution is specific to my general network config.

I was a little bit disappointed as I assumed a standard AP configuration would work out of the box. I actually bought this as a super flexible/configurable device (and it definitely is) to play with VLAN but I never got there.

iwikus · Thu Dec 21, 2023 2:44 pm

Hi all (re-posting here from viewtopic.php?p=1043558#p1043558)
I have updated my hAP ac2 and switched to wifi-qcom-ac drivers.
Seems there is problem with my old ipad mini 2 running software version 12.5.7. Ipad is unable to connect to wifi network, it is reporting invalid password.
But password is correct. Androids works ok, windows 10 ok, even old rpi connects ok.

AP shows only this in log:

debug: 6C:70:9F:1F:49:86@wifi5g associated, signal strength -80
debug: 6C:70:9F:1F:49:86@wifi5g disassociated, connection lost, signal strength -80

So I confirm, there is some problem which is already reported here in this thread.

I have already tried to turn off WPA3(-PSK), but I want to use ft (roaming) feature. I will do a try without ft enabled, but this was reason why I upgraded.

iwikus · Thu Dec 21, 2023 2:45 pm

Confirming iPad mini 2 and iPad Air work fine with WPA3, WPA2 and management frames enabled, but ft disabled.

So despite that Apple article, seems something isn't quite happy with FT on this generation of device running version 12.5.7.

Do you think that apple will release some fix? Or it is AP problem?

ToTheFull · Thu Dec 21, 2023 3:15 pm

It doesn't appear Mikrotik have any interest in fixing this, you will get silly replies like you entered the password wrong from staffers around here.

nonolk · Thu Dec 21, 2023 3:31 pm

@iwikus honnestly I don't know, the only thing I can say is that I have still a ticket open at Mikrotik support for this issue.

iwikus · Thu Dec 21, 2023 7:17 pm

As a workaround I have created virtual ap with other essid and security profile, which have FT (roaming) disabled. Now Ipad is able connect to this network. Also I have opened support case - SUP-138357

EDIT: Upgraded to 7.14beta4 and migrated to CAPSMAN. Same issue - when FT is enabled, ipad mini2 does not connect. Using virtual AP with different ssid and FT disabled - ipad is working. So I think they will be pushed to fix it, when apple owners will complain.

Kentzo · Thu Dec 21, 2023 11:01 pm

I remotely remember having an issue with iPad (Pro, gen. 2, os ver. 17.x) connecting to WiFi after I replaced my AP (RB952Ui -> C53UiG) and changed authentication to WPA3-PSK while keeping SSID. It displayed the same silly error about the wrong password. Had to delete the WiFi config on the iPad and reboot before it was able to reconnect.

If you're willing, there is a way to troubleshoot: https://developer.apple.com/bug-reporti ... s-and-logs. You will install a profile on the device that enables logging and will need Xcode to collect them. Not easy, but the only way to learn why it's failing.

It doesn't appear Mikrotik have any interest in fixing this, you will get silly replies like you entered the password wrong from staffers around here.

It's not uncommon to copy-paste passwords with extra whitespaces...

Fri Dec 22, 2023 9:45 am

Yes, iOS doesn't just remember the password, it remembers all security settings. Just "forget network" and connect once more.

nonolk · Fri Dec 22, 2023 10:17 am

@normis of course this was already tested, without success.

mkx · Fri Dec 22, 2023 11:12 am

As already mentioned (in numerous topics in this forum): some slightly older wireless devices don't like at all if AP announces features that devices don't know about. Which includes new security certification bundles (WPA3) or encryption algorithms (e.g. gcmp or gcmp-256) or even newer radio standards (e.g. 802.11ax). And it's those devices which are actually at fault, devices are supposed to be both backward-compatible (so that they work with APs that don't support everything that station supports) but they are supposed to be future-proof in a sense that they gracefully ignore anything that they don't actually support. Alas I've seen devices (LTE) which claimed to support certain new features where in reality they didn't (or they did in a very twisted vendor-specific way), but the net effect was that such device misbehaved in a completely standard-compliant network.

It could be that some vendors can "fake" things when they detect a "problematic" client trying to connect, MT generally doesn't have any of such hooks. So it's up to AP admin to configure network such that also such problematic devices can live. It may mean that there's a virtual interface with "crippled" security parameters which allow those devices to connect.

And no, even renowned brand name like Apple is not immune from doing things their way (in fact, they have a track record of doing things their way and later pushing it on the rest of universe).

nonolk · Fri Dec 22, 2023 6:26 pm

@mkx, and as I already explained before despite I’m sharing your experience, you are out of topic… FT is stated as supported https://support.apple.com/en-us/103274 so it should not a problem, and more I’ve tested the same device on an Aruba network with 802.11kr activated, and it just work. And of course as a workaround I created a second ssid with FT disabled since the introduction of FT, and yes it works, but this is only a workaround not a real solution.

Fri Dec 22, 2023 6:32 pm

Another possibility is that Aruba, in order to minimize issues in certain areas or for certain clients, decided to bend instead of break and complied to "the Apple way".
Like mkx indicates as well.

jonmansey · Fri Dec 22, 2023 7:41 pm

To highlight another example where it’s a grey area, yesterday I added a cap ax to my network, and capsman set it to 5845. Of course none of my Apple (or any) devices could even see it. So is that mikrotik’s fault, or apple’s?

Worked around by setting channels to 5180-5825. For it to be user-friendly, the defaults shouldn’t give you a non-working setup.

Kentzo · Fri Dec 22, 2023 9:51 pm

@nonolk You'd do God's work if you could troubleshoot on iPad and collect the logs. I'd do it myself, but have no device to reproduce it.

infabo · Fri Dec 22, 2023 10:16 pm

I doubt that FT itself is the problem.

It could be anything else that changes in ROS when enabling FT.

So with all respect, I can confirm the issue on an ipad mini 3 with iOS 12. There is even an reset networking option ("If you're using iOS or iPadOS 14 or earlier, tap Settings > General > Reset > Reset Network Settings."
https://support.apple.com/en-us/HT20405 ... 20Settings.) and this nukes everything. Still no success. This iOS version should support 802.11k/v and still there is this issue. Several people reported here the same.

mkx · Fri Dec 22, 2023 10:27 pm

So is that mikrotik’s fault, or apple’s?

It's a generation mismatch, MT supports part of U-NII-4 frequencies while your Apple doesn't (some other, more contemporary model, might support it already). The same consideration is if sone 802.11a device roams onto modern AP operating on a DFS channel, where's the promlem then? And would you require default config to skip those channels (yeah, some AP admins would).
Or the case where clients don't see 2.4GHz AP operating on channels 12 or 13 (until they by some other magic find out they're not in NA).

So in short: it's your fault

nonolk · Sat Dec 23, 2023 11:09 am

@mkx there I fully agree with you.

@kentzo https://developer.apple.com/bug-reporti ... -and-logs/ here is the way to collect logs on Idevices, and believe me or not it produce lot, if you are using a Mac it’s really easy to get it, with a PC you need third party software to collect it.

@holvoetn I don’t think so, but I’m more and more thinking MikroTik is making 802.11r adaptive (which is not supported by this generation of « old device »), I say that because making Wi-Fi analysis show this difference between the Aruba and the MikroTik one, but there is an old answer from FToms said it’s not… (who requested to open a support ticket for this). viewtopic.php?p=994597#p994597

iwikus · Wed Jan 03, 2024 3:09 pm

Seems mikrotik support does not want to solve it SUP-138357:

Hello,

Our wireless is constantly being updated and new features added, which most likely may not be supported by outdated iOS12 software. Please check ft on a more recent firmware, example iOS17, if the issue still persist please sniff the packet from routerboad to mobile device and sent it to us.

Thank you!

Best regards,

infabo · Wed Jan 03, 2024 10:08 pm

Did you send them this URL along? https://support.apple.com/en-us/103274

Even my crappiest/oldest hardware here can connect to the FT enabled AP. so it may be some edgecase with

.
But as I do not have a

developer account login, I can't access these wifi iOS log instructions from https://developer.apple.com/bug-reporti ... s-and-logs
Always these login-hidden Infos I won't play this game.

infabo · Wed Jan 03, 2024 11:09 pm

Found a way to read ipad mini 3 syslog using MacOs and "libimobiledevice".

So possibly the relevant lines when connecting to a FT-enabled AP:

Jan  3 22:08:39 Preferences(MobileWiFi)[166] <Notice>: WiFi:[726008919.525281]: __WiFiSecurityCopyPassword:[jupiter-guest] Error result -25300
Jan  3 22:08:39 Preferences(WiFiKit)[166] <Error>: -[WFNetworkProfile password]: password is nil for jupiter-guest
Jan  3 22:08:39 Preferences(MobileWiFi)[166] <Notice>: WiFi:[726008919.565370]: __WiFiSecurityCopyPassword:[jupiter-guest] Error result -25300
Jan  3 22:08:39 kernel(IO80211Family)[0] <Notice>: com.apple.p2p: AWDL is off
Jan  3 22:08:39 wifid[40] <Notice>: Apple80211DisassociateExt: disassocReason:8
Jan  3 22:08:39 kernel(IO80211Family)[0] <Notice>: com.apple.p2p: setJoiningState AWDL (AUTO mode) already disabled for association attempt (state 0x21 OFF) join status 1
Jan  3 22:08:39 kernel(IO80211Family)[0] <Notice>: com.apple.p2p: AWDL is suspended
Jan  3 22:08:39 kernel(IO80211Family)[0] <Notice>: com.apple.p2p: setJoiningState AWDL exiting QUIET mode because of joinDone, status 2
Jan  3 22:08:39 kernel(IO80211Family)[0] <Notice>: com.apple.p2p: AWDL is off
Jan  3 22:08:39 wifid[40] <Notice>: WiFi:[726008919.645985]: Failed to associate with jupiter-guest: 5
Jan  3 22:08:39 Preferences(MobileWiFi)[166] <Error>: _WiFiCopyUnserialized: Invalid buffer/buffersize.
Jan  3 22:08:39 Preferences(MobileWiFi)[166] <Notice>: WiFi:[726008919.649544]: WiFiSecurityRemovePassword: Removing password for jupiter-guest
Jan  3 22:08:39 wifid[40] <Notice>: WiFi:[726008919.647255]: Failed to join(5 - 0x5): jupiter-guest
Jan  3 22:08:39 rapportd(MobileWiFi)[70] <Error>: _WiFiCopyUnserialized: Invalid buffer/buffersize.
Jan  3 22:08:39 sharingd(MobileWiFi)[54] <Error>: _WiFiCopyUnserialized: Invalid buffer/buffersize.
Jan  3 22:08:39 rapportd(MobileWiFi)[70] <Error>: _WiFiCopyUnserialized: Invalid buffer/buffersize.
Jan  3 22:08:39 sharingd(MobileWiFi)[54] <Error>: _WiFiCopyUnserialized: Invalid buffer/buffersize.
Jan  3 22:08:39 rapportd(MobileWiFi)[70] <Error>: _WiFiCopyUnserialized: Invalid buffer/buffersize.
Jan  3 22:08:39 sharingd(MobileWiFi)[54] <Error>: _WiFiCopyUnserialized: Invalid buffer/buffersize.
Jan  3 22:08:39 rapportd(MobileWiFi)[70] <Error>: _WiFiCopyUnserialized: Invalid buffer/buffersize.
Jan  3 22:08:39 sharingd(MobileWiFi)[54] <Error>: _WiFiCopyUnserialized: Invalid buffer/buffersize.
Jan  3 22:08:39 Preferences(WiFiKit)[166] <Error>: -[WFNetworkListController _handleAssociationResult:error:network:profile:]: error Error Domain=com.apple.wifikit.error Code=11 joining network <private>
Jan  3 22:08:39 Preferences(WiFiKit)[166] <Error>: -[WFNetworkListController _handleAssociationError:network:profile:]: Network requires a scan before associating
Jan  3 22:08:39 Preferences(WiFiKit)[166] <Error>: -[WFNetworkListController _handleAssociationError:network:profile:]: already scanned, finishing association

Someone over here https://developer.apple.com/forums/thread/690602 had similar log entries.

Amm0 · Thu Jan 04, 2024 2:16 am

Found a way to read ipad mini 3 syslog using MacOs and "libimobiledevice".

Is there some reason you cannot upgrade from iOS 12, that's pretty old. Whether there is an Apple or Mikrotik bug, neither are going to fix it be my concern.

But I guess a couple things to try on the Mikrotik side:
1. Is your country set correctly and/or perhaps try other country settings (like etsi, united states)?
2. If the Wi-Fi SSID has no password, perhaps enable OWE encryption?

On the Apple side, only thing is perhaps disable LTE data and/or Wi-Fi Calling and see if it connects then.

nonolk · Thu Jan 04, 2024 11:42 am

@infabo, you don't need and apple devlopper account to do get the debug profiles

, you just have to use a standard appleID (I do not have one devlopperID)

infabo · Thu Jan 04, 2024 12:16 pm

I have an Apple-ID, but they locked my account for no reason. Did not need it anyways and I had no muse to call their phone support.

infabo · Thu Jan 04, 2024 12:23 pm

@Amm0 iOS 12.5.7 is the latest version for iPad mini 3. Follow the thread and there is already one solution: disable FT. But I do not want to disable FT. And according to APPLE docs iOS supports 802.11r for ipad mini 3. https://support.apple.com/en-us/103274. But maybe MT FT is "Adaptive 802.11r" and there is no ipad mini 3 listed as supported.

Thu Jan 04, 2024 12:39 pm

I have an Apple-ID, but they locked my account for no reason. Did not need it anyways and I had no muse to call their phone support.

You need to do that anyway. How can you use your device without AppleID? You are locked out of like majority of features

infabo · Thu Jan 04, 2024 3:42 pm

I do not use that iPad regularly. Only use case: car streaming device for kids. It connects to my smartphone hotspot successfully - so I do not care much if it connects to my MT AP. But would be nice to have for e.g. download movies for offline usage.

Regarding apple id: yes, MacOS and iOS keep nagging me to enter my

ID. But for the things I am using, I don't care much for the

cloud

. I never signed in for iCloud, I just have this

ID because they forced me into signing up for it.

nonolk · Thu Jan 04, 2024 4:55 pm

@infabo, so why not applying the proposed workaround of one slave configuration on a virtual wifi interface with FT disabled ( I must use another SSID of course), this is what I'm using as a workaround.

infabo · Thu Jan 04, 2024 5:06 pm

agreed. already have a slave config for guests. so this already does the job.

OT:
Why does MT still use terms like master/slave?

mkx · Fri Jan 05, 2024 8:21 am

Why does MT still use terms like master/slave?

And what terms do you propose to use? I'm so sick of this political correctness (if you're hinting at it) ...

Fri Jan 05, 2024 9:19 am

I do not use that iPad regularly. Only use case: car streaming device for kids. It connects to my smartphone hotspot successfully - so I do not care much if it connects to my MT AP. But would be nice to have for e.g. download movies for offline usage.

Regarding apple id: yes, MacOS and iOS keep nagging me to enter my ID. But for the things I am using, I don't care much for the cloud . I never signed in for iCloud, I just have this ID because they forced me into signing up for it.

You can't install apps without it

infabo · Fri Jan 05, 2024 9:22 am

from App Store. No need for it on MacOS, and on iOS I don't care for updates because some apps don't get updates anyways because of old iOS 12.

infabo · Fri Jan 05, 2024 9:39 am

Why does MT still use terms like master/slave?
And what terms do you propose to use? I'm so sick of this political correctness (if you're hinting at it) ...

I am not lobbying for political correctness here. It is just because big parts of the whole IT ecosystem are moving away from "legacy" terms. Git's default branch is now named main instead of master. whitelist/blacklist is now Allowlist/Blocklist in many software.

You asked for a proposal: main interface instead of master interface.

I am no activist and basically I am not affected (and living in a German speaking country in Europe where this discussion never happened). That's for the political part. But when I observe the industry moving away from these terms I would not ignore that.

And basically yes, keep BC and don't break. I would have said: keep it as is (master) to avoid config breaks. But then 7.13 happened and the whole wave2 menu was nuked away. So no argument here.

I am not proposing a change, I just wanted to mention it. Someone responsible at MT can collect the Infos and then make a decision.

Fri Jan 05, 2024 9:49 am

Yes, but in all seriousness, what would you propose? We tried to think of an alternative, but there is nothing that would be self explainatory.

whatever · Fri Jan 05, 2024 9:55 am

You asked for a proposal: main interface instead of master interface.

That would be misleading as there can be multiple master interfaces. I think it should be kept as master/slave, from a technical perspective it's perfect naming and immediately clarifies the relation between these interfaces.

infabo · Fri Jan 05, 2024 12:10 pm

According to docs there can't be multiple master interfaces. Just one. "master-interface"
https://help.mikrotik.com/docs/display/ ... nterface,-(interface

Master/slave is typically 1:1 or 1:n (1 master, multiple slaves). I can't think of any m:n relation when the terms master/slave is used typically.

You argument is busted.

whatever · Fri Jan 05, 2024 1:40 pm

Each dual-band wifi device has two master interface, one for 2 GHz and one for 5 GHz.

levicki · Thu Jun 13, 2024 10:08 pm

Are people so idle nowadays with nothing better to do than look for things to rename and history to revise?

Don't answer, it's a rhetorical question.

Back on topic of Apple devices, from my testing these are the settings that work:

- Authentication Type: WPA3 PSK
- Encryption: CCMP
- Group Encryption: CCMP
- Disable PMKID
- Management protection: Required
- Management encryption: GMAC 256
- WPS Disable
- DH Groups 19
- SAE PWE: Hash to element

That's based on extensive testing with latest iOS and iPhone 15 Pro Max and it's the highest possible security for WPA3 Personal and Apple devices -- all other combinations of security settings result in them failing to connect.

Hopefully it helps someone and I really wish Mikrotik had this in their documentation so I didn't have to waste so much time trying all the combinations of authentication / security / etc.

Of course, you can still use WPA2 if you want, but you should not mix WPA2 and WPA3 (so called transitional, Apple advises against it).

ToTheFull · Thu Jun 13, 2024 10:44 pm

Just a side note, Ipad Air2 doesn't know what wpa3 is and neither will it connect to a network with FT enabled either.
So I have no choice but to mix!

https://support.apple.com/en-gb/guide/s ... 7fa93d/web

Thu Jun 13, 2024 10:58 pm

Downgrade your wifi settings so everything is happy or replace tablet/offending device so it can comply to modern standards or create separate SSID with lower settings only for tablet or ...

You always have a choice but you need to choose.

Who is online