We have a problem with an upgrade of a mikrotik router (configured as wireless station) from 2.8.27 to 2.9.14 and “default authentication” (wireless interface):
Version 2.8.27:
Router is only allowed to connect to one single AP (“default authentication” is disabled and the one allowed MAC is registered within the access list). This works. Station connects to that AP.
After the upgrade to 2.9.14:
Router does not connect to that AP any more with “default authentication” disabled and the AP within access list. If I enable “default authentication” (DA), the station is able to connect to APs.
I added a working AP (this station got successfully connection to that AP with enabled DA) to the access list and disabled DA again. The station should connect to the AP, but it’s only searching for network and does not connect.
I downgraded from 2.9.14 back to 2.8.27 and everything worked like before.
Any hints for that phenomenon? Known issue?
Informations about the station:
Licence level 5
I upgraded with regular packages (not with routeros-x86)
The MAC of the AP, to which the station should connect, was within the access list. But with disabled default authentication the station didn’t connect to that AP.
Is there a new option in 2.9, which does not exist in 2.8, which is set to a to much secure default value if you upgrade? (Security profile could be a candidate, but should be set to none. The ssid is the same on station and AP.)
Bad testing situation, because the station is normaly only reachable via wlan for us. So a broken wlan-connection means… well… no connection
For wireless clients you don’t use the access-list, but the connect-list to specify which APs the client may associate to.
The details of this process are documented in the manual.
The problem seems to be, that the connect list does not exist within 2.8, but does exist in 2.9. So with 2.8 I have to register the mac of my desired AP within the access list (see below) and with 2.9 I have to use the connect list.
Assumption: If I upgrade from 2.8 to 2.9 I have an empty connect list, because it’s not possible for MT to decide, which entry from my access list should be within the new connect list instead of the access list.
If I’m right, this should be documented at least on http://wiki.mikrotik.com/wiki/2.8_to_2.9
(Maybe I can test my assumption - but it will not be possible very soon.)
insel
–
Version 2.8, description of Access List:
The access list is used by the Access Point to restrict associations of clients and by clients to restrict associations to a given list of APs.
Version 2.9, description of Connect List
The Connect List is a list of rules (order is important), that determine to which AP the station should connect to.
Version 2.9, description of Access List:
The access list is used by the Access Point to restrict associations of clients.
I suppose the easiest/quickest way would be to enable default-authentication just before the upgrade, then upgrade and lock down the system again with the new connect-list feature (if desired)…
One thing to note though:
If you are using the connect-list feature on your customers CPEs, you might run into trouble if your AP wireless interface should die. You can easily put in another (new) interface at the AP, reconfigure - and get nothing, because clients won’t associate because of unknown/changed MAC address on the AP side.
You can of course work around by changing the MAC address of the new wireless card to that of the old card, but… hmmm… I believe in having the device actually HAVING the MAC address that’s printed on it.
This way becomes more difficult, if you try this remote and you know, that there is more that the one AP, to which the station have to connect to . I think, this update have to be done on site.
Yes, no printed information on the device or within the documentation is sometimes better than a wrong or out-dated information.
Insel
(From Freiburg im Breisgau, southwest of Germany)
Just for the record / problem (and solution) searching people: Upgraded that station from 2.8.27 to 2.9.14 on site and inserted desired mac-address to the connection list. It connected without problems or more configuration necessary.
One thing to note though: