Skip to main content
robert_espi
robert_espi
New Member
January 17, 2024
Question

Wifi handhshake stuck at 1/4

  • January 17, 2024
  • 14 replies
  • 9395 views

We're using Fortigate 7.0.12 and most of our FortiAPs are at version 7.0.0. Our main models are 421E and 221E. Our building has two floors. With two AP, on each floor located at the front corners. We've set specific channels and power levels. Everything was fine until this week.

Our Guest Wi-Fi (SSID) uses WPA2-Personal PSK.

Lately, we've noticed a problem. Some clients, like Windows, Android, and IOS devices, are having trouble finishing the 4-way handshake randomly. Looking at the logs, it seems like the AP and client start talking, but when the AP sends the first message in the 4-way handshake, the client doesn't respond. The AP tries three more times, but the client stays quiet. In the end, the client's device shows an authentication error, and our Fortigate log says there's a client-deauthentication error.

The weird part is, if we take the same device to another part of the building and connect to a different AP of the same model and firmware, it works fine.

This situation has us scratching our heads. We've heard about PMF, but our setup doesn't seem to have anything related to it. Any advice would be really helpful. Thanks

14 replies

AEK
SuperUser
AEK
SuperUser
January 17, 2024

When you say everything was fine before, what was the last change before the issue started? Any firmware upgrade? Any config change?

AEK
    robert_espi
    robert_espiAuthor
    New Member
    January 17, 2024

    No change or anything. It was first reported recently so I was just checking logs and noticed it.

    Hong_FTNT
    Staff & Editor
    Hong_FTNT
    Staff & Editor
    January 17, 2024

    Hi @robert_espi,

     

    You can run the following debugs on the FortiGate (replace xx:xx:xx:xx:xx:xx with clients MAC address):

     

    di deb res 

    diagnose wireless-controller wlac sta_filter xx:xx:xx:xx:xx:xx 255
    diagnose debug console timestamp enable
    diagnose debug enable

     

    Regards,

      aruncie
      aruncie
      New Member
      June 27, 2024

      Hey Robert - did you happen to find a resolution on this?  Sitting in the same boat at the moment

      robert_espi
      robert_espiAuthor
      New Member
      July 1, 2024

      Hi, there actually isnt a fix to this (that i know of). I had to find a work around, which was to create an automation stitch to reboot the APs every morning. Rebooting the AP resolved the issue,  since then I haven't had this issue again ..If anyone finds a permanent fix, feel free to share. 

        TommyMaz
        TommyMaz
        Visitor III
        August 7, 2024

        Having the same issue with FAP 431G on 7.4.2. This happens every 2-3 months and our current workaround is a rolling reboot of all FAPs.

        Also worth noting, the clients will continue to try to connect to a problematic AP even though an AP that is working normally is within range.

          pilat_nember
          pilat_nember
          New Member
          August 23, 2024

          I have about 450 APs in my network (231F, 431F, 433F), the problem is only with 431F and 433F. According to Resolved issues for 7.4.3, the problem should have been solved. I report that the problem is not solved and restarting several tens of APs in continuous operation every few days is a bad solution in my opinion :(

          ehernandez13
          ehernandez13
          Visitor III
          March 27, 2025

          Having the same issue with FAP 431G on 7.2.2. This happens every week and our current workaround is a rolling reboot of all FAPs. Does anyone know any other solution?

          tudorodagiu
          tudorodagiu
          New Member
          March 27, 2025

          Hi, i got around 500 ap in one location. It was a nightmare since beginning, 7.4.5 i think fix It. Now i run the latest 7.4.7 i think. Another thing that i did was to split the process that manages the ap in the fortigate in 8. I run this on a 1800f FortiGate. 

            ehernandez13
            ehernandez13
            Visitor III
            March 27, 2025

            Thanks for the feedback, what do you mean by splitting the AP management process?

            Georgesalazar
            New Member
            July 27, 2026

            ​@hbac We're using Fortigate 7.0.12 and most of our FortiAPs are at version 7.0.0. Our main models are 421E and 221E. Our building has two floors. With two AP, on each floor located at the front corners. We've set specific channels and power levels. Everything was fine until this week.

            Our Guest Wi-Fi (SSID) uses WPA2-Personal PSK.

            We are perplexed by this circumstance. Although we've heard of PMF, it doesn't appear to have anything to do with our setup. Any guidance would be very beneficial. Thank you

            Georgesalazar
            New Member
            July 27, 2026

            Having the same issue with FAP 431G on 7.2.2. This happens every week and our current workaround is a rolling reboot of all FAPs. Does anyone know any other solution?

            Hello, I received over 500 ap in one place. It was a disaster from the start; I believe 7.4.5 will cure it. I believe I'm now running the most recent 7.4.7. I also divided the Fortigate's AP management procedure into eight parts. I use an 1800f FortiGate to run this.

            hawkrobbert
            New Member
            July 27, 2026

            Having the same issue with FAP 431G on 7.4.2. This happens every 2-3 months and our current workaround is a rolling reboot of all FAPs.

            Also worth noting, the clients will continue to try to connect to a problematic AP even though an AP that is working normally is within range.

            I appreciate your input. Could you perhaps clarify what you mean by "splitting the AP management process"?

            Terms & ConditionsAccessibility statement