Wifi handhshake stuck at 1/4

[robert_espi]

We're using Fortigate 7.0.12 and most of our FortiAPs are at version 7.0.0. Our main models are 421E and 221E. Our building has two floors. With two AP, on each floor located at the front corners. We've set specific channels and power levels. Everything was fine until this week.

Our Guest Wi-Fi (SSID) uses WPA2-Personal PSK.

Lately, we've noticed a problem. Some clients, like Windows, Android, and IOS devices, are having trouble finishing the 4-way handshake randomly. Looking at the logs, it seems like the AP and client start talking, but when the AP sends the first message in the 4-way handshake, the client doesn't respond. The AP tries three more times, but the client stays quiet. In the end, the client's device shows an authentication error, and our Fortigate log says there's a client-deauthentication error.

The weird part is, if we take the same device to another part of the building and connect to a different AP of the same model and firmware, it works fine.

This situation has us scratching our heads. We've heard about PMF, but our setup doesn't seem to have anything related to it. Any advice would be really helpful. Thanks

[AEK]

When you say everything was fine before, what was the last change before the issue started? Any firmware upgrade? Any config change?

[robert_espi]

No change or anything. It was first reported recently so I was just checking logs and noticed it.

[hbac]

Hi @robert_espi,

You can run the following debugs on the FortiGate (replace xx:xx:xx:xx:xx:xx with clients MAC address):

di deb res 

diagnose wireless-controller wlac sta_filter xx:xx:xx:xx:xx:xx 255
diagnose debug console timestamp enable
diagnose debug enable

Regards,