Apple 12" MacBook (2017) to hAP ax2 via 2GHz and 5GHz drops during large data transfer

RouterOS Wireless Networking
1

Hi –

Info: new hAP ax2 running 7.8, MacBook 12" 2017 (capable of 2ghz, 5ghz, WPA2, WPA3, has had no issues with hAP ac2 on 6.x series).

I’ve looked at the Apple Macbook issues with 5GHz Wi-Fi thread (http://forum.mikrotik.com/t/apple-macbook-issues-with-5ghz-wi-fi/162045/1) and have a similar configuration. Have tried WPA2 and WPA3.

I’m able to initially connect just fine, and light browsing/etc. works okay. But when I try to perform a TimeMachine backup (lots of data), the connection drops and takes several minutes to reconnect. This, of course, kills the backup, which will never complete unless I’m on a wired network. Here’s what’s in the logs:


Mar/05/2023 18:44:22 78:4F:43:xx:xx:xx@xxxx-wlan-5 connected, signal strength -51
Mar/05/2023 18:47:16 78:4F:43:xx:xx:xx@xxxx-wlan-5 disconnected, connection lost, signal strength -56

I reset the MacBook’s SMC, NVRAM, and ran diagnostics. Changed physical positions, tried on power, tried on battery. Unlike the above forum post, this happens on both 2Ghz and 5GHz networks.

This did not happen on the hAP ac2 I’ve been rocking for several years if I stayed on the 6.x series. I remember trying to upgrade to 7.x and had to downgrade because of poor WiFi reliability (this exact issue). I don’t have the option of downgrading to 6.x on the ax2, of course.

(UPDATE) Switching the 2GHz network to 802.11n (2GHz N) kept the connection from dropping. I’d rather use 802.11ax (2GHz AX) so that other devices can benefit from it. I’m unwilling to downgrade my 5GHz network full-time, so it looks like this device will have to “slum it” on 2GHz. Do any Mikrotik engineers know whether work is ongoing with the wifiwave2 hardware/firmware/software to improve the backward compatibility of AX to N (for 2GHz) and AX to AC (for 5GHz)?

(SECOND UPDATE) Also confirmed that the client connects via WPA2 and WPA3 equally and without disconnects on the 802.11n (2GHz N) network, so it’s not related to authentication. CCMP and GCMP “standard” and 256 options are also enabled on the router.

Anybody have anything else I can try to improve the backward compatibility of AX? Since I have a reproducible environment, I’m happy to try different scenarios and post my results to this forum. I imagine there are other devices with a similar wifi chipset on the client side.

– Justin

2

Hello, I have the same problem.
I have several apple devices, iPhones 12, 13, MacBooks, Air 13 M1, MacBook 12 2017.
After switching from Hap AC Lite to Hap AX 2, I had problems with Wi-Fi on MacBook 12. The problem described by the author coincides 100%.
I tried making factory settings, custom Wi-Fi settings, updating the firmware to 7.11, beta, downgrading - it doesn’t help.
I tried updating the OS versions of MacBook, 11, 12, 13 Mac OS - it doesn’t help.
I tried changing encryption types, frequencies and many other settings in the router. Nothing helps, the Wi-Fi connection stops working after 1-3 minutes.

Help me please!

3

make sure you are on the latest RouterOS version, then enable wireless debug logging (in system logging, add new rule with topics “wireless,debug”). Then see detailed logs during this disconnect

4

We have about 2000pcs ax2 in the field and all apple MBP 2017 have wifi problems with this AX2 product when mikrotik ax2 wifi is configured as AX. After switching off 5Gz and 2.4GHz to N instead of AX, the macbook wifi is stable. Mikrotik OS version 7.12. MBP latest OS
MBP works totally fine with other 5GHz wifi AP’s . Really bad that it takes so long for mikrotik to solve these wifi issues with AX2 product.

5

If you have 2000 devices in the field, I would think you have some leverage to get this corrected through support channel ?

6

How exactly to do that in Winbox? … help please. Thanks a lot!

7

Another datapoint here. I can consistently reproduce this by…well… connecting any Macbook (not air, not pro, just … macbook 2017) to the hAP ax2 via 2GHz and 5Ghz.

I have 4 androids, 4 iphones, 2 thinkpads running linux, 2 macbook air 2013, 3 macbook pros and macbooks 2017. Only the Macbooks 2017 start dropping connections after a few minutes. Connecting the Macbooks 2017 to other wireless access points of various brands and versions does not trigger the dropping of network. It is definetly in the combo hAP ax2 and Macbook 2017.

Both in routeros 7.6 and 7.8 and 7.12.1

8

looks like i solve this puzzle…

I use 3rd network for mac (the 1st one is still affected):

/interface/wifi> print
Flags: M - MASTER; B - BOUND; X - DISABLED, I - INACTIVE, R - RUNNING
Columns: NAME, MASTER-INTERFACE, CONFIGURATION.MODE, CONFIGURATION.SSID, CHANNEL.FREQUENCY
#     NAME       MASTER-INTERFACE  CONFIGURATION.MODE  CONFIGURATION.SSID  CHANNEL.FREQUENCY
0 MBR wifi2                        ap                                                       
1   X wifi2_old  wifi2             ap                  Home_old                         2412
                                                                                        2437
                                                                                        2462
2 MBR wifi5                        ap                                                       
3  BR wifi5_old  wifi5             ap                  Home_old                             


/interface/wifi> configuration/ print 
Flags: X - disabled 
 0   name="5G-AX" mode=ap ssid="Home" security=Sec_Home_5G 
     security.ft=yes .ft-over-ds=yes .connect-priority=0 
     datapath=datapath1 channel=5G-AX 
 1   name="5G-AC" mode=ap ssid="Home" security=Sec_Home_5G 
     security.ft=yes .ft-over-ds=yes .connect-priority=0 
     datapath=datapath1 channel=5G-AC 
 2   name="2G-AX" mode=ap ssid="Home" security=Sec_Home_2G 
     security.ft=yes .ft-over-ds=yes .connect-priority=0 
     datapath=datapath1 channel=2G-AX 
 3   name="2G-N" mode=ap ssid="Home" security=Sec_Home_2G 
     security.ft=yes .ft-over-ds=yes .connect-priority=0 
     datapath=datapath1 channel=2G-N


/interface/wifi> channel/ print 
Flags: X - disabled 
 0   name="5G-AX" frequency=5180 band=5ghz-ax 
 1   name="2G-N" frequency=2412,2437,2462 band=2ghz-n width=20mhz 
 2   name="5G-AC" frequency=5180 band=5ghz-ac 
 3   name="2G-AX" frequency=2412,2437,2462 band=2ghz-ax
 
  /interface/wifi> security/print 
Flags: X - disabled 
 0   name="Sec_Home_2G" authentication-types=wpa2-psk,wpa3-psk group-encryption=ccmp group-key-update=1h passphrase="12345678" 
     management-protection=allowed connect-priority=0 

 1   name="Sec_Home_5G" authentication-types=wpa3-psk group-encryption=ccmp group-key-update=5m passphrase="12345678" disable-pmkid=yes 
     management-protection=required management-encryption=cmac
9

And same issue is here http://forum.mikrotik.com/t/apple-macbook-issues-with-5ghz-wi-fi/162045/1

10

Have a hAP ax2 and Iphone 13 pro+ Iphone 15 pro max
WiFi 5G - AX + WPA3
Wifi 2G - AX + WPA2/WPA3 (For old phone)

Wi-Fi in Mikrotik, as always, is not their strong point. In the morning I didn’t notice when I was on the mobile Internet and none of the Wi-Fi networks were connected. I think maybe I should have just bought Archer for 1.5k UAH with 5GHz and do not fooled myself. The question is, what the hell happened. Why can’t Mikrotik team be done properly? And last night I saw how phones fall away from Wi-Fi and only connect when you pick them up.


after few minutes Iphone has disconect with identical message like that.

disconnected, connection lost, signal strength -56

I’ll try the recommendations and update this post with the results.

11

Do you have different SSID’s, @strelokr?
Can you by chance share your config?

/export file=anynameyoulike

Remove serial and any other private info and post between code tags by using the </> button.

12

Hello erlinden
Thank you for attention to my problem.
yeap, I’m specialy use diffirent SSID.
My notes.
In 5Ghz - both Iphone disconected and connected automaticly when device in standby mode. when devices is active - there is no problem at all.
Try test how it’s works in 2Ghz AX - Iphone disconected in all end with message

20:16:42 wireless,info 16:3F:4E:XX:XX:XX@wifi2 connected, signal strength -57
 20:16:46 dhcp,info defconf deassigned 192.168.22.10 for 16:3F:4E:XX:XX:XX 
 20:16:47 dhcp,info defconf assigned 192.168.22.10 for 16:3F:4E:XX:XX:XX 
 20:25:16 wireless,info 16:3F:4E:05:76:6D@wifi2 disconnected, connection lost, signal strength -51

2Ghz N-only WPA2/WPA3

 20:30:15 wireless,info 16:3F:4E:XX:XX:XX@wifi2 connected, signal strength -61
 20:30:20 dhcp,info defconf deassigned 192.168.22.10 for 16:3F::XX:XX:XX 
 20:30:21 dhcp,info defconf assigned 192.168.22.10 for 16:3F::XX:XX:XX 
 20:35:59 wireless,info 16:3F:4E:XX:XX:XX@wifi2 disconnected, connection lost, signal strength -52

UDDATE
Test 5Ghz AC - not help.
Both phones disconnect from Wi-Fi when they fall asleep in standby mode. I don’t understand over what period this happens. And in standby mode it is on LTE. When you pick up the phone it tries to connect to Wi-Fi and I notice this. When the phone is active, Wi-Fi does not disconnect. Perhaps the reason is that Mikrotik does not track when the device “falls asleep in standby mode”.

Here is my config

[admin@MikroTik_hAP ax^2] > export
# 2024-02-21 20:40:26 by RouterOS 7.13.5
# software id = XXXX-XXXX
#
# model = C52iG-5HaxD2HaxD
# serial number = HFXXXXXXXXX
/interface bridge
add admin-mac=78:9A:XX:XX:XX:XX auto-mac=no comment=defconf name=bridge port-cost-mode=short
/interface wifi
set [ find default-name=wifi2 ] channel.band=2ghz-n .skip-dfs-channels=all configuration.country=Ukraine .mode=ap .ssid=MikroTik disabled=no security.authentication-types=\
    wpa2-psk,wpa3-psk .connect-priority=0 .ft=yes .ft-over-ds=yes
/interface list
add comment=defconf name=WAN
add comment=defconf name=LAN
/interface wifi security
add authentication-types=wpa3-psk connect-priority=0 disabled=no name=MySec
/interface wifi configuration
add channel.skip-dfs-channels=10min-cac country=Ukraine disabled=no name=tp-link200 security=MySec security.ft=yes .ft-over-ds=yes ssid=tp-link200
/interface wifi
set [ find default-name=wifi1 ] configuration=tp-link200 configuration.mode=ap disabled=no name=wifi5

/ip pool
add name=dhcp ranges=192.168.22.10-192.168.22.254
/ip dhcp-server
add address-pool=dhcp interface=bridge lease-time=10m name=defconf
/interface bridge port
add bridge=bridge comment=defconf interface=ether2 internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf interface=ether3 internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf interface=ether4 internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf interface=ether5 internal-path-cost=10 path-cost=10
add bridge=bridge comment=defconf interface=wifi2 internal-path-cost=10 path-cost=10
add bridge=bridge interface=wifi5
/ip neighbor discovery-settings
set discover-interface-list=LAN
/interface list member
add comment=defconf interface=bridge list=LAN
add comment=defconf interface=ether1 list=WAN
/ip address
add address=192.168.22.1/24 comment=defconf interface=bridge network=192.168.22.0
/ip dhcp-client
add comment=defconf interface=ether1 use-peer-dns=no
/ip dhcp-server network
add address=192.168.22.0/24 comment=defconf dns-server=192.168.22.1 gateway=192.168.22.1 netmask=24
/ip dns
set allow-remote-requests=yes use-doh-server=https://1.1.1.1/dns-query verify-doh-cert=yes
/ip dns static
add address=192.168.22.1 comment=defconf name=router.lan
/ip firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMP" protocol=icmp
add action=accept chain=input comment="defconf: accept to local loopback (for CAPsMAN)" dst-address=127.0.0.1
add action=drop chain=input comment="defconf: drop all not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept in ipsec policy" ipsec-policy=in,ipsec
add action=accept chain=forward comment="defconf: accept out ipsec policy" ipsec-policy=out,ipsec
add action=fasttrack-connection chain=forward comment="defconf: fasttrack" connection-state=established,related hw-offload=yes
add action=accept chain=forward comment="defconf: accept established,related, untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop all from WAN not DSTNATed" connection-nat-state=!dstnat connection-state=new in-interface-list=WAN
/ip firewall nat
add action=masquerade chain=srcnat comment="defconf: masquerade" ipsec-policy=out,none out-interface-list=WAN
/ipv6 dhcp-client
add disabled=yes interface=ether1 pool-name=test-ipv6 request=prefix
/ipv6 firewall address-list
add address=::/128 comment="defconf: unspecified address" list=bad_ipv6
add address=::1/128 comment="defconf: lo" list=bad_ipv6
add address=fec0::/10 comment="defconf: site-local" list=bad_ipv6
add address=::ffff:0.0.0.0/96 comment="defconf: ipv4-mapped" list=bad_ipv6
add address=::/96 comment="defconf: ipv4 compat" list=bad_ipv6
add address=100::/64 comment="defconf: discard only " list=bad_ipv6
add address=2001:db8::/32 comment="defconf: documentation" list=bad_ipv6
add address=2001:10::/28 comment="defconf: ORCHID" list=bad_ipv6
add address=3ffe::/16 comment="defconf: 6bone" list=bad_ipv6
/ipv6 firewall filter
add action=accept chain=input comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=input comment="defconf: drop invalid" connection-state=invalid
add action=accept chain=input comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=input comment="defconf: accept UDP traceroute" port=33434-33534 protocol=udp
add action=accept chain=input comment="defconf: accept DHCPv6-Client prefix delegation." dst-port=546 protocol=udp src-address=fe80::/10
add action=accept chain=input comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=input comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=input comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=input comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=input comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
add action=accept chain=forward comment="defconf: accept established,related,untracked" connection-state=established,related,untracked
add action=drop chain=forward comment="defconf: drop invalid" connection-state=invalid
add action=drop chain=forward comment="defconf: drop packets with bad src ipv6" src-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: drop packets with bad dst ipv6" dst-address-list=bad_ipv6
add action=drop chain=forward comment="defconf: rfc4890 drop hop-limit=1" hop-limit=equal:1 protocol=icmpv6
add action=accept chain=forward comment="defconf: accept ICMPv6" protocol=icmpv6
add action=accept chain=forward comment="defconf: accept HIP" protocol=139
add action=accept chain=forward comment="defconf: accept IKE" dst-port=500,4500 protocol=udp
add action=accept chain=forward comment="defconf: accept ipsec AH" protocol=ipsec-ah
add action=accept chain=forward comment="defconf: accept ipsec ESP" protocol=ipsec-esp
add action=accept chain=forward comment="defconf: accept all that matches ipsec policy" ipsec-policy=in,ipsec
add action=drop chain=forward comment="defconf: drop everything else not coming from LAN" in-interface-list=!LAN
/system clock
set time-zone-name=Europe/Kiev
/system identity
set name="MikroTik_hAP ax^2"
/system note
set show-at-login=no
/tool graphing interface
add interface=ether1
/tool graphing resource
add
/tool mac-server
set allowed-interface-list=LAN
/tool mac-server mac-winbox
set allowed-interface-list=LAN
13

Test situation in my work. wAP_AC 5Ghz AC
Iphone Uptime looks correct. But ping package lost 60% when iphone in sleep mode. But Iphone is not disconnect from WiFi. Looks like there are no network traffic from iphone for energy saving purpose

14

@strelokr, have you tried increasing the lease time in the DHCP settings? Currently, it’s set to 10 minutes. What if we try 1 day?

15

I will try. But in my logic DHCP is not related with WiFi at all.

16

iPhone disconnects from WiFi in standby mode if a low lease time is set. I experienced this with my iPhone XS once.

17

Activate wireless & debug, that might give sme insights. Turned out my iPhone 11 had difficulties with combined WPA2-PSK and WPA3-PSK. Turned off WPA3-PSK, after that I didn’t run into problems anymore.

The problem I ran into, was that this phone couldn’t roam. Turned out (from the logging) that I was experiencing “invalid FT IEs”.

18

Thank you a lot. Set DHCP Lease time to 30 Days and now happy to see 02H and 32Minutes UpTime


[admin@MikroTik_hAP ax^2] /interface/wifi/registration-table> print 
Flags: A - AUTHORIZED
Columns: INTERFACE, SSID, MAC-ADDRESS, UPTIME, SIGNAL
#   INTERFACE  SSID        MAC-ADDRESS        UPTIME   SIGNAL
0 A wifi5      tp-link200  1E:79:75:XX:XX:XX  2h33m6s  -52   
1 A wifi5      tp-link200  A4:F9:33:XX:XX:XX  28m14s   -53   
2 A wifi5      tp-link200  3A:A8:E5:XX:XX:XX  3m17s    -63
19

Cool😊

20

Strange behavior. In the morning I went to Mikrotik using the WinBox mobile application, I see the uptime my device for more than 10 hours, I run a speed test, and I see that the indicator shows that I am working on LTE. But the speed is more than 100 mb/sec in both directions. It cannot be LTE (its speed is about 30-40). And on Mikrotik there are no logs that the device was disconected. Apparently the iPhone does not show the truth about where it is connected.