5GHz channels disappeared on hAP ax2

I’m starting to despair with Mikrotik Wi-Fi. Yeah, yeah I know - why do I even persist as it really is their weak point :frowning:

I wanted to get some experience of RouterOS v7 and Wi-Fi 6 so I bought a hAP ax2 before Christmas to use at home on my dev network. I’ve gone from never having to worry about the Virgin Media SuperHub to seeming to have Winbox open all the time! You wouldn’t expect VM to get praise!

Today’s problem - latest version v7.13 and I wondered why my laptop seemed to be very slow transferring an ISO. Checked Wi-Fi and it’s connected at 2.4GHz. Now this does sometimes happens with Windows so I turned Wi-Fi back off and on, sat 2m from the router. No difference. Brought up Wi-Fi analyser on my mobile and the 5GHz channels have totally disappeared. Just the distant neighbours Virgin Media SuperHub:

I disabled and re-enabled the wireless interfaces (I have a private LAN and guest VLAN) and it’s come back:

I see there are quite a few posts about problems with Mikrotik AX :frowning: Anything obvious to try? At a clients site, the cap AC access points have to be rebooted every night to maintain a stable system…

Check log for radar detection / DFS events. Do you have non-DFS channels configured as well?

I’ll check the logs but as I rebooted it about 5 mins ago, I’ve lost overnight. Can the logs be written to a syslog server? The AX2 doesn’t have a USB socket so can’t write them to a pen drive.

Even if there was a radar/DFS event, as it’s currently configured for auto, shouldn’t it move to another channel if a conflict popped up?

If another frequency is available, then it should switch channels on DFS events, yes. That’s why I was asking. Maybe just set channel to 5180 and check if it still disappears.

Maybe just set channel to 5180

Good idea - that will isolate whether it’s software or hardware related.

Another possibility when device is set to default (wide) frequency range: hAP ax2 chooses to use one of U-NII3 channels which are not supported by not-so-recent wireless devices.

It had gone again this morning but I’ve had to come out so no chance to diagnose further. The only change I made yesterday was changing the SSID to distinguish between the 2.4GHz and 5GHz channels. 2.4GHz still working fine. Later…

I’ll share the configuration later once I’ve read through it myself.

Yes, got me surprised with my first ax(2) device. Quite a wide range in 5GHz, probably not supported by my PC (it has an ax wifi card (MediaTek Wi-Fi 6 MT7921 Wireless LAN Card)), or only at low power. Those frequencies are new to me as well. http://forum.mikrotik.com/t/default-password-frustration/172021/1

Use CLI command “/interface/wifiwave2/radio> print detail” and see what freq you can get for your country as it is set.
Wifi1 interface status showed it used the high upper range (5865) , out of the box.

EDIT EDIT EDIT

And I learned later that …

  • all above 5700MHz in Europe is max EIRP level of only 14dBm (16dBm below that of the lower frequencies)
  • default country (none set) changed in ROS 7.13.1 to Latvia (that has those low ETSI/Europe EIRP levels)
  • the hAP ax prefers those high freq if not told otherwise
  • the hAP ax2 disappeared from my test devices, because the signal was way too weak

Back home. The automatic frequency chosen is 5720/ax/eeeC (DFS). I assume that means it’s operating in these channels:

Now here is where it gets interesting… my Xiaomi Redmi Note 12 can’t see the 5GHz Wi-Fi network at all but a Lenovo laptop that I happen to have on the bench is connected to the 5G network fine.

Notes on the phone: it’s new and is the only device I’ve got that supports Wi-Fi 6. It can certainly operate on channels 132-144. It can also use channels 149 upwards which sometimes.

The eeeC bit is interesting… I asked on another post about how you configured sidebands on ROS7/Wave2 as the user interface is different to ROS6. In ROS6, you can pick Ceee, eCee, eeCe and eeeC. I can’t see how do that with ROS7. I was told you can put 5180 in frequency and that indeed works - but forcing Ceee. I wonder if I put 5200 in there that I’d get eCee?

I’m just about to force 5180 and see how it is for a few days.

I was told you can put 5180 in frequency and that indeed works - but forcing Ceee. I wonder if I put 5200 in there that I’d get eCee?

Immediate follow-up, yes this is indeed how it works. Consider this part of the spectrum:

5180 - Ceee
5200 - eCee
5220 - eeCe
5240 - eeeC

I was working through the various channels, testing each one with my mobile and on 5680, it started working and then said “failed to select channel”

And a key entry in the log: private-5g: radar detected on 5680/ax/eCee. This isn’t always occurring butt might start to give some hint as to what’s going on. If there are radar events (unusual, never seen before here but who knows), shouldn’t the router try and find a different frequency when the frequency is set to blank/auto?

This is the result of testing with my laptop and Android mobile:

5180/ax/Ceee OK
5200/ax/eCee OK
5220/ax/eeCe OK
5240/ax/eeeC OK

5660/ax/Ceee OK
5680/ax/eCee OK
5700/ax/eeCe OK
5720/ax/eeeC FAILED

The mobile is unable to connect on that very last configuration which happens to be the one that auto keeps favouring. Now I know I can set the frequency manually, I’m more intrigued here why the mobile (and it happens my Android tablet) struggles with that particular configuration. Because it’s not the range 5650-5730 as such as 5660 works. It’s when the control channel is on 5720. Probably not Wi-Fi 6 chipset in mobile either as Wi-Fi 5 tablet struggles too.

I dropped the channel width down to 20MHz and went through 5660, 5680, 5700 and 5720. It’s the last one that’s problematic for sure. Could connect (mobile & tablet) on the first three but not last. Once again, laptop fine on all of them.

I’m going to dig out an AC router which I think I’ve got in the box and have a play on that.

Interesting read once I isolated the problem:

https://www.emperorwifi.com/2015/09/the-limitations-of-channel-144.html

“Channel 144 (5.720 GHz) is a 20 MHz channel that is a part of the UNII-2e band. It was added in March 2014 specifically as part of the official 802.11ac specification, so that the new Wi-Fi amendment would support an additional 80 MHz channel of 132-144 (see the figure above).”

“What this means in practice is that you can ONLY use channel 144 as part of an 80 MHz channel, and must use the Upper Extension (or Upper / Upper or Upper / Lower), so that 40 MHz and 20 MHz legacy clients would avoid the use of Channel 144”.

And another post: https://support.accessagility.com/hc/channel-144. Although surprised a 2023 mobile phone has this problem. My Far East tablet is more understandable.

IMO I think ROS should avoid 5720/ax/eeeC for this reason.

Putting this one to bed for now. I’ve repeated the problem on a hAP AC lite. If channel 144 is used as the control/main channel, then some devices are unable to connect. Not specifically older devices either. My XiaomiRedmi Note 12 Pro 5G was released less than a year ago and it has the same problem.

IMO ROS should avoid channel 144 as the control channel (5720/ax/eeeC) for this reason. In auto mode, it should also really avoid channel 149 and above as well as that’s got problems with some devices.

Of course, one should probably avoid auto entirely and pick a channel after a site scan. However, this isn’t always perfect if other access points are around on auto and hop onto the carefully chosen channel.

Back from a week’s holiday and the 5GHz interface has disappeared again. Disabling and re-enabling the 5GHz wireless interfaces gets it back. I might script that each night. Certainly something amiss. The 2GHz interface is fine. I notice there has been an update since I’ve been away so fingers crossed only “wifi-qcom” seems vaguely related to this.

You should check the logs and/or winbox wifi-tab and/or the output of “/interface/wifi/print detail” (which should show interface-errors as comments in output).

There must be a reason why 5ghz is down. Of course you can disable/enable to get it up again. But then you can’t inspect the “non working state” anymore.

If you are sure this is not a config issue (we can’t judge on this, because you did not post your config here), you can create a supout.rif once 5ghz is non-working again. Toggle 5ghz interface to get it running again. Then create another supout.rif. Send these 2 files to MT support and let them inspect.

# 2024-01-29 11:29:04 by RouterOS 7.13.3
# software id = 8SND-BECL
#
# model = C52iG-5HaxD2HaxD
# serial number = HE508WV8MKT
/interface bridge
add admin-mac=48:A9:8A:64:E9:B4 auto-mac=no comment=defconf name=bridge \
    port-cost-mode=short
/interface vlan
add interface=bridge name=guest-vlan vlan-id=10
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
add name=VLAN
/interface wifi security
add authentication-types=wpa2-psk,wpa3-psk disabled=no name=middle-earth
add authentication-types=wpa2-psk,wpa3-psk disabled=no name=shire
add disabled=no name=open
/interface wifi
set [ find default-name=wifi2 ] channel.band=2ghz-ax .skip-dfs-channels=\
    10min-cac .width=20/40mhz configuration.country="United Kingdom" .mode=ap \
    .ssid="Middle Earth" disabled=no name=private-2g security=middle-earth
set [ find default-name=wifi1 ] channel.band=5ghz-ax .frequency=5500 \
    .skip-dfs-channels=10min-cac .width=20/40/80mhz configuration.country=\
    "United Kingdom" .mode=ap .ssid="Middle Earth 5G" disabled=no name=\
    private-5g security=middle-earth
add configuration.mode=ap .ssid="The Shire" datapath.vlan-id=10 disabled=no \
    mac-address=4A:A9:8A:64:E9:B9 master-interface=private-2g name=guest-2g \
    security=shire
add configuration.mode=ap .ssid="The Shire" datapath.vlan-id=10 disabled=no \
    mac-address=4A:A9:8A:64:E9:B8 master-interface=private-5g name=guest-5g \
    security=shire
/ip pool
add name=guest ranges=10.0.0.10-10.0.0.254
/ip dhcp-server
add address-pool=guest interface=guest-vlan lease-time=2h name=guest
/system logging action
set 3 remote=192.168.0.7
/interface bridge port
add bridge=bridge comment=defconf interface=ether2 internal-path-cost=10 \
    path-cost=10
add bridge=bridge comment=defconf interface=ether3 internal-path-cost=10 \
    path-cost=10
add bridge=bridge comment=defconf interface=ether4 internal-path-cost=10 \
    path-cost=10
add bridge=bridge comment=defconf interface=ether5 internal-path-cost=10 \
    path-cost=10
add bridge=bridge comment=defconf interface=private-5g internal-path-cost=10 \
    path-cost=10
add bridge=bridge comment=defconf interface=private-2g internal-path-cost=10 \
    path-cost=10
add bridge=bridge interface=guest-2g internal-path-cost=10 path-cost=10
add bridge=bridge interface=guest-5g internal-path-cost=10 path-cost=10
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface detect-internet
set detect-interface-list=all
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
add interface=guest-vlan list=VLAN
/interface wifi access-list
add action=accept comment="Frodo 5G" disabled=no mac-address=\
    00:45:E2:81:E4:61
add action=accept comment="Treebeard 2G" disabled=no mac-address=\
    1C:BF:CE:4D:15:52
add action=accept comment=Mobile disabled=no mac-address=56:95:CC:AA:40:9F
add action=accept comment=Mobile disabled=no mac-address=02:53:E4:D5:F1:16
add action=accept comment=Helmsdeep disabled=no mac-address=5C:E0:C5:E3:E1:99
add action=accept comment="Epson printer" disabled=no mac-address=\
    38:1A:52:18:30:36
add action=accept comment="Echo Dot" disabled=no mac-address=\
    74:E2:0C:AC:E4:4A
add action=accept comment="Heater smart plug" disabled=no mac-address=\
    FC:67:1F:B8:B7:88
add action=accept comment=Tablet disabled=no mac-address=02:C5:0B:DD:34:CF
/ip address
add address=192.168.0.1/24 comment=defconf interface=bridge network=\
    192.168.0.0
add address=10.0.0.1/24 interface=guest-vlan network=10.0.0.0
/ip dhcp-client
add comment="Virgin Media modem WAN" interface=ether1
/ip dhcp-server network
add address=10.0.0.0/24 dns-server=1.1.1.1,8.8.8.8 gateway=10.0.0.1
/ip dns
set allow-remote-requests=yes
/ip dns static
add address=192.168.0.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment="Accept established,related,untracked" \
    connection-state=established,related,untracked
add action=drop chain=input comment="Drop invalid packets" connection-state=\
    invalid
add action=accept chain=input comment="Accept ICMP (ping)" protocol=icmp
add action=accept chain=input comment=\
    "Accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=accept chain=input disabled=yes in-interface-list=VLAN
add action=drop chain=input comment="Only allow access to router from LAN" \
    in-interface-list=!LAN
add action=accept chain=forward comment="Accept in ipsec policy" \
    ipsec-policy=in,ipsec
add action=accept chain=forward comment="Accept out ipsec policy" \
    ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment=\
    "Fasttrack existing connections through firewall (no rules applied)" \
    connection-state=established,related hw-offload=yes
add action=accept chain=forward comment=\
    "Accept established,related, untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="Drop invalid" connection-state=invalid
add action=drop chain=forward comment=\
    "Drop all from WAN not DSTNATed (block incoming connections)" \
    connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="Default NAT out" ipsec-policy=\
    out,none out-interface-list=WAN
add action=dst-nat chain=dstnat comment="Port forward SimpleHelp TCP" \
    dst-port=8008 in-interface-list=WAN protocol=tcp to-addresses=192.168.0.7 \
    to-ports=8008
add action=dst-nat chain=dstnat comment="Port forward SimpleHelp UDP" \
    dst-port=8008 in-interface-list=WAN protocol=udp to-addresses=192.168.0.7 \
    to-ports=8008
add action=dst-nat chain=dstnat comment="Port forward HTTP" dst-port=80 \
    in-interface-list=WAN protocol=tcp to-addresses=192.168.0.14 to-ports=80
add action=dst-nat chain=dstnat comment="Port forward HTTPS" dst-port=443 \
    in-interface-list=WAN protocol=tcp to-addresses=192.168.0.14 to-ports=443
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=\
    invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=\
    33434-33534 protocol=udp
add action=accept chain=input comment=\
    "defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=\
    udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 \
    protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=input comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
add action=accept chain=forward comment=\
    "defconf: accept established,related,untracked" connection-state=\
    established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" \
    connection-state=invalid
add action=drop chain=forward comment=\
    "defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment=\
    "defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" \
    hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=\
    icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=\
    500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=\
    ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=\
    ipsec-esp
add action=accept chain=forward comment=\
    "defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment=\
    "defconf: drop everything else not coming from LAN" in-interface-list=\
    !LAN
/system clock
set time-zone-name=Europe/London
/system identity
set name=ROUTER001
/system logging
set 0 action=remote
set 1 action=remote
set 2 action=remote
set 3 action=remote
add action=remote topics=debug
add action=remote topics=wireless
/system note
set show-at-login=no
/tool graphing interface
add interface=ether1
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN

It’s a pretty standard configuration. Only significant additional configuration over basic router configuration is setting up of a guest VLAN and some port forwarding. The 5GHz frequency is set to 5500 to get maximum Tx power.

Logging is going to Kiwi syslog server free running on my Windows server. Might install a Linux syslog server as I can’t work out how to filter in the free version of Kiwi.

Bad blocks of 0.1% is a little unexpected?

[admin@ROUTER001] > /system/resource/print
                   uptime: 2h1m14s
                  version: 7.13.3 (stable)
               build-time: Jan/24/2024 13:16:46
         factory-software: 7.5
              free-memory: 648.9MiB
             total-memory: 960.0MiB
                      cpu: ARM64
                cpu-count: 4
            cpu-frequency: 864MHz
                 cpu-load: 1%
           free-hdd-space: 93.8MiB
          total-hdd-space: 128.0MiB
  write-sect-since-reboot: 728
         write-sect-total: 674230
               bad-blocks: 0.1%
        architecture-name: arm64
               board-name: hAP ax^2
                 platform: MikroTik

Not really. Sooner or later EVERY flash device will have some bad blocks.
As long as it doesn’t increase on a short timeframe, nothing to worry about.

Everytime I see your avatar I think about the apologists.