Technical Tip: 'deny assoc request, no he caps in pure' error on FortiAP

[magarwal]

Description	This article describes the steps to mitigate the users not being able to connect to the WIFI issue.
Scope	FortiAP is being managed by FortiGate.
Solution	When random users are not able to connect to FortiAP enable the #klog on one of the test FortiAP and ask the user to connect to that FortiAP. In the logs below error will be seen: 'deny assoc request, no he caps in pure 802.11ax mode'. This occurs because the FortiAP (FAP) is set to operate in pure 802.11ax (Wi-Fi 6) mode. This configuration means the FortiAP expects client devices to support 802.11ax features, such as High Efficiency (HE) capabilities. If a user device does not support these features or does not include them in its association request, the FortiAP denies the connection. For any enabled PURE, if the client device is not sending the association requests in pure mode then the FortiAP will reject it. Line 3: Line 964: [ 1357.144394] [ASSOC] cpu0 vap-01(wlan01): [a8:93:4a:d5:38:bf] ieee80211_alloc_node,223: vap=0x2a840000, peercount=2, ni=0x31a48000, ni_bss_node=0x31a48000 bss_ref=2 Line 8: Line 971: [ 1357.146138] [ASSOC] cpu0 vap-01(wlan01): [a8:93:4a:d5:38:bf] deny assoc request, no he caps in pure 802.11ax mode Line 10: Line 973: [ 1357.146227] [ASSOC] cpu0 vap-01(wlan01): [a8:93:4a:d5:38:bf] ieee80211_sta_leave: 0x31a48000 Line 12: Line 975: [ 1357.146285] [ASSOC] cpu0 vap-01(wlan01): [a8:93:4a:d5:38:bf] node_cleanup sta_assoc cnt iv 0 ==> 0 ic 0 ==> 0 Line 13: Line 976: [ 1357.146897] wlan: [0:I:ANY] [ASSOC] cpu0 vap-2(wlan01):ieee80211_mlme_frame_complete_handler: nodecount 2 frame 0x10 send to a8:93:4a:d5:38:bf, delayed_clean: 0, leve_ongoing: 1 Line 14: Line 978: [ 1357.146918] wlan: [0:I:ANY] [ASSOC] cpu0 vap-2(wlan01):ieee80211_mlme_frame_complete_handler,808 wbuf ffffffc02d909c00 flags 1 ni a8:93:4a:d5:38:bf delayed_cleanup 0 leave_ongoing 1 ni_assocstatus 0 Line 15: Line 980: [ 1357.146936] wlan: [0:I:ANY] [ASSOC] cpu0 vap-2(wlan01):ieee80211_mlme_frame_complete_handler: Error Assoc resp when peer delete in progress ni: 0xffffffc031a48000, mac: a8:93:4a:d5:38:bf,vapid: 2 d Below are the radio settings seen on the FortiAP. Radio 0: AP    country        : cfg=IN  oper=IN     countryID      : cfg=356 oper=356    802.11d enable  : enabled    sta info       : 0/0    radio type     : 11AX_2.4G (pure AX) Radio 1: AP    country        : cfg=IN  oper=IN     countryID      : cfg=356 oper=356    802.11d enable  : enabled    sta info       : 1/0    radio type     : 11N_5G (pure N) Step to Resolve the Issue: Use FortiAP’s CLI or GUI to check the current radio settings for both the 2.4 GHz and 5 GHz bands. Make sure that multiple bands are passed on the profile and not just one. Below is the radio config seen on FortiAP. Note that now there is no 'Pure' mode seen. By changing the radio configuration to mixed mode, users without 802.11ax (HE) capabilities will be able to associate successfully with the FortiAP.