I was stuck with this error for ages! I recently found a workaround by changing the security profile to use WPA AES CCN (as the only option)! Maybe the problem is the TKIP support or something with the protocol negotiation.
Hope this helps, as i’ve tried before with different NICs (R52 and Gigabyte) and different clients (atheros and ralink) but my RB333 always filled the log with those errors.
18:03:01 wireless,info 00:0C:42:aa:bb:cc@wlan1 established connection on 5320, SSID xx
18:07:31 wireless,info 00:0C:42:aa:bb:cc@wlan1: lost connection, got deauth: group key handshake timeout (16)
18:07:35 wireless,info 00:0C:42:aa:bb:cc@wlan1 established connection on 5320, SSID xx
18:07:40 wireless,info 00:0C:42:aa:bb:cc@wlan1: lost connection, got deauth: 4-way handshake timeout (15)
18:07:45 wireless,info 00:0C:42:aa:bb:cc@wlan1 established connection on 5320, SSID xx
Ok, signal maybe is not so good, but this problem happens also with Nanostation, which take minutes to reconnect, also after a power cycle.
i got around this problem in a very complicated way, the problem appeared to be that the wds-slaves would try to connect to ap with default security profile but the ap side of the wds-slave would use the profile1 of the security profile.
there are 4 wds-slaves using profile1 and 1 ap bridge
when ap bridge is set to profile1 i get the key exchange timeout, so what i did was have the 4 wds-slaves set to profile1 with the wpa2 turned on and the ap bridge one set to default on security profiles and all 4 connect fine and pass traffic and you have to use the passkey to connect to the wds-slaves but the ap is set to wide open.
so now 4 work fine but main is not secure, so i did access-list rules to only allow the repeaters to connect to wlan1 interface and hid ssid on the ap-bridge and on the repeaters i put a connect-list to make the repeaters connect to the wlan1 with the mac address and another rule to not connect to anything else, then on the ap-bridge i created a virtual ap with the same ssid as wlan1 and set that security profile to profile1 and all is good.
now passkey works on all ap’s
if you can filter through all my ramblings it may make sense but its running with wds-slaves and wpa2 and basicly the main ap is set to default and the repeaters have a security profile. So it looks like the client side of wds-slave uses default and the ap side uses whatever you set in the wireless settings. it did work at first just comes and goes like its a bug that randomly uses the default or just doesnt use encryption.
ill do some test where instead of adding profile1 ill just edit default and see if it works.
I have never been able to get WDS aka ap-bridge mode and WPA (psk) to work on routeros 3.x. Windows can connect fine but mikrotik to mikrotik ap-bridge WPA-PSK can not, nor have I ever heard of anyone having it working. I think it is safe to say it’s broken! Feel free to prove me wrong.
This page: http://wiki.mikrotik.com/wiki/Mesh_wds shows a config for WPA-EAP which does seem to work for ap-bridge mode (after very brief testing) but windows clients complain they can’t find a certificate.
I wouldn’t call this thread dead, it is just a long standing defect in routeros. Lots of people seem to have this problem and the only answer to have windows clients and mikrotik WDS from the same SSID is to use WEP, which is only marginally better than no security at all.
WDS and WPA is working between two mikrotik routers.
First make sure that you have specified the correct security profile in the connect-list if you are using it.
Second, we recommend to use wds-mode=dynamic-mesh or static-mesh as it has better link establishemnt for WDS and with that WAP will work better. Note that those new WDS modes are not compatible with the old ones.
I am not using the connect list. I have the MAC addresses specified with wds mode static.
wds-mode=dynamic-mesh and static-mesh don’t appear in the manual nor can anyone find out anything them.
WDS using ap-bridge and wds-mode=static with WPA-psk does not work on mikrotik routeros. It is broken until someone can prove otherwise by providing a working example.
I’ve found that using dynamic-mesh for WDS with WPA encryption does ‘work’, but isn’t useable: the links frequently reset with messages like “no beacons received” or “class 2 frame received (6)” even when there are no clients around to connect to the APs.
I’ve Changed some radios from AP-bridge to station-wds and the links do not reset for months. Of course now clients can’t connect to those radios.
while it is possible to do WDS with WPA in theory, in practice it doesn’t work well enough.
Thought I’d better post what I have discovered to save someone else 1.5 years of frustration.
bridge --------- station perfect link, no AP
ap-bridge ------ station-wds work with encryption, need AP functions, 2-3 reconnects per week
ap-bridge ------ ap-bridge work with no encryption
ap-bridge ------ slave-wds failed to select channel, no link
ap-bridge ------ ap-bridge (WPA or WPA2) unicast key exchange timeout
singal at -70
CCQ 98-100%
it is definitly a ROS problem
is it not possible to get a working WDS with ap-bridge (WPA PSK) mode ?
Some clients are able to connect but most of them can only connect through mac registration tables. We had couple of new computers coming and but now they cant connect even through registration table authentication. It says “unicast key exchange timeout” on router and invalid password on client. They are using intel 3945 wireless cards with tkip ciphers.
if you can filter through all my ramblings it may make sense but its running with wds-slaves and wpa2 and basicly the main ap is set to default and the repeaters have a security profile. So it looks like the client side of wds-slave uses default and the ap side uses whatever you set in the wireless settings. it did work at first just comes and goes like its a bug that randomly uses the default or just doesnt use encryption.