WiFI disconnects / stability problem when WPA3 is enabled (transition Mode from WPA2) within Mesh on AVM products

[tp1de]

I am using a Mesh-Network based on AVM products. There are 3 active WiFi components:

1. Cable-Router far way from ems-esp (-90db) - Mesh master
2. old Router acting as Mesh access point - next room to ems-esp (-60 db)
3. a WiFi Repeater close to ems-esp (50 cm) (- 38 db)

All WiFi attributes are set central on Mesh master are then identically set to all Mesh devices.
AVM is recommending to select a WPA2/WPA3 transition mode for WiFi security. (WPA2 and WPA3 enabled).

With this mode all my devices run stable but ems-esp does not. The ems-esp firmware is changing regularly the access points to be connected to. This is not the strongest one !
I could see that quite often the connection is made to the far away master.

Being away from home two weeks ago I could not connect anymore to the WebUI - but MQTT connection to HA was still working.
After 6 hours another access point was selected and connection to WebUI was possible again.

When using the WPA2/WPA3 transition mode the ems-esp WiFi network scan does not show the right security attributes for the mesh repeaters - only for the master. I might believe that this causes the connection problems.

Selecting fixed WPA2 for WiFi security is recognized for all access points by ems-esp and connection seems to be stable now.
(even changing the access points to be connected to a couple of times per day !)

[proddy]

There's not a lot we can do here in EMS-ESP. We're using the core espressif wifi libraries. You could scan through the forums (https://github.com/espressif/esp-idf) and see if other people have similar issues? Or try the tec build as uses the latest ESP-IDF 5.0 library.

On my Unifi network there are settings to optimize for iot devices - maybe AVM has something similar? Or just fix the IP and AP for the EMS-ESP device?

Or use an ESP32 microcontroller by itself and write a small script that connects to the network to see if you can reproduce it easily.

[MichaelDvP]

The latest espressif API supports WPA3: https://docs.espressif.com/projects/esp-idf/en/latest/esp32/api-guides/wifi-security.html

Afaik most mesh issues are caused by automatic channel changes of the AP. On channel change the connection is disconnected and reconnect is the next possible AP, maybe far away and low signal.

[tp1de]

[tp1de]

Afaik most mesh issues are caused by automatic channel changes of the AP.

I know and therefore I use a fixed channel.

[proddy]

The latest espressif API supports WPA3: https://docs.espressif.com/projects/esp-idf/en/latest/esp32/api-guides/wifi-security.html

Afaik most mesh issues are caused by automatic channel changes of the AP. On channel change the connection is disconnected and reconnect is the next possible AP, maybe far away and low signal.

but not the arduino which we use. We should perhaps fork our own version of the SDK like Tasmota and other projects do. https://docs.espressif.com/projects/arduino-esp32/en/latest/troubleshooting.html?highlight=wpa3#why-does-the-board-not-connect-to-wpa3-encrypted-wi-fi

[MichaelDvP]

Hmm, this is defined in the arduino: https://github.com/espressif/arduino-esp32/blob/0d84018d969309addacbcc3e3782c1fadc95fbc8/tools/sdk/esp32/dio_qspi/include/sdkconfig.h#L356
Maybe that's the cause for the much more flash the newer platform needs?

[tp1de]

WiFi is stable now, when I enable fixed WPA2 within my Mesh network. (WPA2/WPA3 transition mode disabled).
Nevertheless EMS-ESP connects to different access-points regularly. I have no glue why and if there is any short disconnect.
With the changes done for MQTT there are no reboots anymore.

[tp1de]

I recognized that when EMS-ESP reboots (e.g. new firmware upload) WiFi is not automatically reconnected to the strongest access point.

The desired function would be, that on reconnect / reboot a WiFi network scan is done and the strongest access point is used with same SSID and password as stored. (same as selecting it manually but where password has to re-entered even if SSID stays the same).

[proddy]

it's the job of the router to assign a client to an access point and assign an IP. I'm not sure what EMS-ESP (being the client) can influence.

[tp1de]

With a WiFi network scan from WebUI I see all access points with SSID and signal strength. In my case a couple of them with same SSID. There I can select one ems-esp to be connected. So functionality is already available.

.... YES you might be right. I selected a weaker access point and it doesn't work. So forget it.

[proddy]

probably by chance. There is only one line in EMS-ESP to connect to the wifi

WiFi.begin(_state.ssid.c_str(), _state.password.c_str()); // attempt to connect to the network

which takes a SSID and a Password.

[tp1de]

I tested 3.6.0-dev.6 with WPA2/WPA3 transition mode enabled again. Fritz!Box Mesh Network with Cable Router, One access point connected by LAN and a second one by Wifi in the heating room. Buderus Boiler connected by LAN to this and ems-esp connect by WLAN to this access point (50 cm distance).

The findings:

1. ems-connects not always to the nearest and strongest signal access point - this can't be influenced (as discussed before)

2. with wpa2/3 transition mode within wifi network scan all 3 access points are shown but Security: Unknown

3. when connected to an access point in 2 meters distance (1 wall in between) I recognized a lot of spikes in WiFi RSSI time graph:
   

4. These spikes are 3-4 times more often then by just using wpa2.

Conclusion I do not feel save with wpa3/3 transition mode and I will go back to wpa2.

[proddy]

that's a shame. Unfortunately nothing we can fix in EMS-ESP.

[caveman2003]

Hi tp1de,

i have the same issue with AVM... but in addition to the mesh of AVM (2 devices) i have also 2 TP Link (Omada) devices. When i take the device in my working room (TP Link AP 4m distance) WebUI is running perfect, moving back to cellar where only FritzBox is visible (scan show only the box, 2m distance, no walls) WebUI is not reachable anymore... I have also WPA2/WPA3.
And as you, i see on the ESP32 "security unknown". Changing to WPA2(CCMP) and scan again "security WPA2" is shown...

From my point of view this is realy strange because authentication to WLAN is done only on the Fritz not on the TP Link ...

Strange is that i have in the cellar an other ESP32 with Tasmota (+ an Pi Zero... but this is totaly different). The ESP32 with Tasmota haven't show any problems with WPA2/WPA3....

[tp1de]

Yes I still confirm WPA3 connection problems with AVM devices. I think this is not related to mesh but rather the WPA3 implementation.
Since I switched back to WPA2(CCMP) the WiFi connection is long-term stable.

[proddy]

I've running EMS-ESP on an S3 with the latest dev 3.6.x, on WPA3 for the last few days and haven't noticed any drops.

[tp1de]

I think the problem is related to AVM's FritzBox WPS2/WPA3 transition mode.

[MichaelDvP]

I've tested with AVM fritzbox 7530 and have no issues with WPA2/WPA3. But i don't have a mesh.

[tp1de]

I do have a FB 6591 with Vodafone Firmware 7.29 and two Mesh repeaters with different FW releases. This might give the problem with WPA3 ... but WPA2 is fine and stable for the meantime.
Do you already have 7.5x ?

[MichaelDvP]

Do you already have 7.5x ?

V7.56 (release) and some "labor" before.
Ems-esp shows in network scanner Security unknown, i'll add the modes WPA2_WAP3_PSK(7) and WPA3_PSK(6) for web-display. For the fritzbox is shows than WPA/WPA3, correctly identified.

And ems-esp connects with WPA3:

[MichaelDvP]

Seems the WPA3 is only stable if compiiled with the latest dev platform. The official esp32 build with older platform (due to memory) have issues with the WPA3 mixed mode. The S3 build works.

[proddy]

On my to-do is still to figure out why the latest IDF v4.4.4 increases the Flash by 20%. I was going to try and use some of the analysis tools to compare the two to find which library is causing it and then find ways to disable it. I couldn't get the pio analysis to work so looking now into https://docs.espressif.com/projects/esp-idf/en/latest/esp32/api-guides/performance/size.html . Then we can all use platform-espressif32 version v6.3.2