topic WPA3 connection without transition mode in Aerohive Migrated Content

WPA3 connection without transition mode

AnonymousM — Wed, 16 Oct 2019 02:26:05 GMT

I have an AP630 using HiveOS 10.0r7a. I am able to select WPA3 as an Authentication type and then disable transition mode. The result is the AP beacons the AKM type as SAE only. I have tried to connect mobile devices that have passed the WFA WPA3 certification, but I am unable to connect these mobile devices. I tried on 3 different mobile devices that passed the WFA certification for WPA3, but all 3 devices failed. Has anyone successfully connected a device using WPA3 and if so, what was that device?

Re: WPA3 connection without transition mode

samantha_lynn — Fri, 18 Oct 2019 23:36:51 GMT

Would you be able to send me tech data from the AP that is pulled directly after a device is unable to authenticate? Please also include the MAC address of the client device that failed. If you'd like to send this to me directly, my email address is communityhelp@aerohive.com.

Re: WPA3 connection without transition mode

AnonymousM — Fri, 18 Oct 2019 23:52:54 GMT

How do I acquire the tech data from the AP? I can send it to you along with the MAC address of the client device to the email you provided. I am unaware of the procedure to acquire the tech data from the AP. Thank you.

Re: WPA3 connection without transition mode

samantha_lynn — Fri, 18 Oct 2019 23:56:01 GMT

This guide reviews how to collect tech data via the HiveManager GUI: https://thehivecommunity.aerohive.com/s/article/How-to-download-tech-data-in-HiveManager

And this guide covers how to get tech data from the CLI of the AP, in case that's easier: https://thehivecommunity.aerohive.com/s/article/Collecting-Tech-Data-via-CLI

Re: WPA3 connection without transition mode

AnonymousM — Sat, 19 Oct 2019 00:29:02 GMT

Thank you Sam! I will send you the tech data early next week at communityhelp@aerohive.com

and reply to this thread once I sent the email.

Re: WPA3 connection without transition mode

AnonymousM — Tue, 22 Oct 2019 00:16:00 GMT

Hello Sam,

I sent 2 emails to the communityhelp@aerohive.com email.

Subject: WPA3 failure 1 of 2 = WiFi network configured with WPA3 with Transition mode OFF. The Auth Key Management within the RSN only contains SAE. The phone fails to connect.
Subject: WPA3 failure 2 of 2 = WiFi network configured with WPA3 with Transition mode ON. The Auth Key Management within the RSN contains both PSK and SAE. The phone SUCCESSFULLY connects using SAE.

Both emails have the the tech data from the AP and a WiFi capture. I used the same phone for both tests (Samsung Galaxy S10 running Android 9). I included the MAC address of the phone in both emails.

Re: WPA3 connection without transition mode

samantha_lynn — Tue, 22 Oct 2019 00:26:14 GMT

Thank you for that data but unfortunately the first set of data (packet capture and tech data) did not contain that MAC address at all. You can see this in the packet capture if you run the filter: eth.addr == <MAC address>. In the second set of data, the packet capture had no data with that MAC address and the tech data saw two probes from that client, but no authentication attempts or failures. Would you be able to replicate again and pull tech data immediately after replicating? You can search for the MAC in the tech data to be sure we captured the event.

Re: WPA3 connection without transition mode

AnonymousM — Tue, 22 Oct 2019 00:30:34 GMT

Your Wireshark display filter is incorrect. Try: wlan.addr==<MAC address> for the 2 WiFi addresses I provided. I just tried it and it worked on both captures.

Re: WPA3 connection without transition mode

AnonymousM — Tue, 22 Oct 2019 02:10:20 GMT

I looked within both of the "show_tech_result.txt" files. With the WPA3 transition mode set to ON, I was able to see a successful connection to the AP630. However, with the WPA3 transition mode set to OFF, I did not observe any clients associated with the AP. Within the "show_tech_results.txt" files, I did a search for the command "show amrp client". The results:

WPA3 with transition ON = showed Total 1 local L2 client with the MAC address I provided for the phone

WPA3 with transition OFF = showed no devices connected

Re: WPA3 connection without transition mode

samantha_lynn — Tue, 22 Oct 2019 02:22:16 GMT

Thank you, I see that now. I need to review this with our experts, I'll update you as soon as we know more.

Re: WPA3 connection without transition mode

AnonymousM — Tue, 22 Oct 2019 02:37:35 GMT

Thank you Sam for all your help!

Re: WPA3 connection without transition mode

samantha_lynn — Tue, 22 Oct 2019 21:44:40 GMT

Thank you for your patience. I've been reviewing this data with our experts and they've asked that we file a ticket for this question so we can get all of the data and troubleshooting notes in one place. If you could please open a support case and let me know the case number, I'll upload all of the date you've given me so far and fill out the notes to indicate what we've done so far.