14 years lasting BUG - disconnected, unicast key exchange timeout

tommix · Sun Jan 30, 2022 4:27 pm

I dont understand, how it's possible to manufacture so called router os and still have this HUGE, 14 years nover solved problem?
How to fix it??? I have Shelly device, it connects to wifi and after few seconds receives "disconnected, unicast key exchange timeout, signal strength -52".
WHy this bug is not resolved and this IS bug 100%. Why i NEVER ever had any problems with ANY of my used non MikroTIk routers exept this one, Chateau LTE12.
Im not even talking about super duper unstable 5g wifi it have.
Group Key update is set to 35mins. NO matter this setting, no matter frequency..nothing matters... this is why this is bug and MikroTik fails to fix it 14 years already!
Using latest fw 7.2RC3, but this happens on ANY fw.
I have like 20 such devices... What a piece of sh. is MikroTik soft!

image_2022-01-30_171617.png

RogerWilco · Sun Jan 30, 2022 7:32 pm

So you have an issue and instead of posting with an actual question and your config, you wait 14 years and post a rant (without proofreading)?

ivicask · Sun Jan 30, 2022 7:39 pm

I dont understand, how it's possible to manufacture so called router os and still have this HUGE, 14 years nover solved problem?
How to fix it??? I have Shelly device, it connects to wifi and after few seconds receives "disconnected, unicast key exchange timeout, signal strength -52".
WHy this bug is not resolved and this IS bug 100%. Why i NEVER ever had any problems with ANY of my used non MikroTIk routers exept this one, Chateau LTE12.
Im not even talking about super duper unstable 5g wifi it have.
Group Key update is set to 35mins. NO matter this setting, no matter frequency..nothing matters... this is why this is bug and MikroTik fails to fix it 14 years already!
Using latest fw 7.2RC3, but this happens on ANY fw.
I have like 20 such devices... What a piece of sh. is MikroTik soft!

image_2022-01-30_171617.png

Try setting key update to "1d 00:00:00"

bpwl · Sun Jan 30, 2022 9:47 pm

2 hints seen in the forum:

No special characters in PSK: viewtopic.php?t=116480#p799611
Setting Advanced 'distance' to "indoors" instead of "dynamic" may stabilise the timing for key exchange. One can even set a value : viewtopic.php?p=900289#p900289

tommix · Mon Jan 31, 2022 7:47 pm

NOTHING helps that's the problem. This issue is leading MikroTik 14 years and till this day there is no solution! I tried every one i found on the this forum, and there is ike 12 topics about this and as always 0 attention from MikroTIk. Latvian devlopers just like russian ones - never accepts that they made misstake and should fix it.
How crappy software have to be so that client can not connect to router!?? What i have to do now? i have 20 smart devices that can not connect to this router! With Asus i have 0 problems, with TP-LINK have 0 problems... for some reason this "Advanced" router so advanced that even most basic stuff doesn't work!
MikroTIk 13 years ago had to make setting to disable this unicast key check! If they dont know how to fix it.

So you have an issue and instead of posting with an actual question and your config, you wait 14 years and post a rant (without proofreading)?

You giving 0 value to this topic so move on to some other topic. I provided all info needed - all the rest routers in the world works and MikroTik doesnt. That's it!

Zacharias · Mon Jan 31, 2022 7:54 pm

2 hints seen in the forum:

No special characters in PSK: viewtopic.php?t=116480#p799611
Setting Advanced 'distance' to "indoors" instead of "dynamic" may stabilise the timing for key exchange. One can even set a value : viewtopic.php?p=900289#p900289

Last time i had to deal with that issue was with some wireless automation devices that someone else had installed to a customer, it wasn't the password the problem in that case, but to my surprise it was the SSID name.
The devices would not connect at all, i had repeated unicast exchange timeout messages in the log from all the devices, after trying almost everything, i just changed the SSID name, before it had some numbers and spaces in it if i remember correctly, changing it to just a simple word without numbers, spaces, symbols etc the devices connected right away...

infabo · Mon Jan 31, 2022 10:51 pm

When you experience this bug for 14 years now, you are probably able to write down the needed steps to reproduce the issue. Or post your configuration (/export hide-sensitive). This kind of improves the chance to find a solution. And even with all that information and details you could post here, a solution may still not be found by simply config tinkering. BUT then you could head over to MT support, provide them a link to this topic with all the high quality background information. MT then can try to reproduce the issue in their labs and this long lasting nasty bug could finally be resolved after so many many years.

RogerWilco · Mon Jan 31, 2022 11:21 pm

You giving 0 value to this topic so move on to some other topic. I provided all info needed - all the rest routers in the world works and MikroTik doesnt. That's it!

A bit rich. You haven’t provided and detail. Where are the steps to reproduce? Where is your config? What have you tried? Where is your MT ticket?

gotsprings · Tue Feb 01, 2022 11:53 am

Roger wilco

I don't like the guy's writing style either...

But there are some "issues" in Mikrotik wireless that relate DIRECTLY to their proprietary driver.

My tickets were addressed and Mikrotik clearly stated that they could reproduce the issue I was having.

Switching vendors for wifi was a bitter pill to swallow... But the amount of complaints and trouble tickets made it absolutely essential.

jbl42 · Tue Feb 01, 2022 2:59 pm

Switching vendors for wifi was a bitter pill to swallow... But the amount of complaints and trouble tickets made it absolutely essential.

This and the simple fact that MT WiFi still lacks MU-MIMO, Bandsteering, 802.11k/v/r mandated for almost all customer installation those days.
The "wave2" package does not count as it only runs on a few devices and still misses most of the things above. No to speak of the poor stability, lack of 2.4G support on RB4011 and no CAPSMAN.

As a csutomer, it looks like MT has given up on WiFi after they lost touch with WiFi technology progress some 5 years ago.

pe1chl · Tue Feb 01, 2022 3:18 pm

As a csutomer, it looks like MT has given up on WiFi after they lost touch with WiFi technology progress some 5 years ago.

I agree with that. MikroTik are not in competition anymore in the indoor WiFi market. Their own fault.

tommix · Wed Feb 02, 2022 3:04 am

OK here's update. And news are good.

Im NOT sure what helpped! But now all devices connects!

Also what i found BY MYSELF! Thank's to crappy Latvian english MikroTik when logging error "unicast key exchange timeout" - they really mean INCORRECT PASSWORD! (tried loggin to wifi with phone by entering wrong wifi pass and logged the same error).
Anyway i created many virtual AP, done OPEN security, done easy pass, complex pass, any possible encryption combination and solo...Changed many channels, changed billion times group key update interval..and so on. Nothing helped.

BUT today i wanted to last time try it.. so again i go to Shelly web interface again enter wifi datails and it connected! I did this 30x times prevously-never helped..and now i works.
So i did this with other shelly device [other type] - worked too! Dont know why...i changed NOTHING from previuos tries.
SO as always with MikroTik and X-Files - The Truth Is Out There..

ate fanboys who are sooo USLESS in this forum, seen so many topic when those idiots just thinks that every user is god damn RouterOs wizard and knows every possible command...
RouterOs is crappy os. There should be 2 layers, easy one and advanced. Im developer myself and when you give users all the possible options -this ALWAYS leads to probles.
MikroTik would be GREAT in home user sector..but FAILS big time at configuration UI. There are so many openSOurce projects they can take inspiration from.. but no...
BUt i guess they are doing it... will release in 2022 Q4

Longstory short: You may need to tripple check if your pass correct! if yes -then wait... magic happens.

jprietove · Wed Feb 02, 2022 10:03 am

BUGS in Layer 8 are much older than 14 years... and will last forever

Wed Feb 02, 2022 10:51 am

Thank's to crappy Latvian english

As a native English speaker, I can tell you that "unicast key exchange timeout" is perfectly cromulent English. Unhelpful in your case, yes, but there's no problem of language translation here.

The real mystery to me is why you're digging into the router logs to learn of a bad WiFi PSK in the first place. Shouldn't diagnosing that be up to your client OS?

MikroTik when logging error "unicast key exchange timeout" - they really mean INCORRECT PASSWORD!

I'm sure it means exactly what it says.

I don't think the message needs to change, but possibly to be augmented with further information between the "connected" and "disconnected" states to explain how you got from one to the next.

That said, let us not forget that these devices are storage and CPU-constrained, so they must be riding a line of how much information to log. I've seen too-verbose logging take big Xeon servers down.

RouterOs is crappy os.

I agree! It could not possibly be the case that one who makes so many typos and spelling mistakes could be at fault when it comes to typing a WiFi PSK. It's definitely the fault of RouterOS.

easy one and advanced.

There are easy UIs for RouterOS: Quick Set and the mobile apps. You could arguably toss SwOS into that box, too.

I've used network equipment with simplified interfaces, and what it always means is that to achieve it, the vendor has either pre-set or neglected to support every advanced option you might want. Yes, RouterOS takes more time to master, but I'd rather have the option to learn something new about it than to not have the features at all.

In any case, I fail to see how paring the configuration UIs down even further would help in this case. To take it to an extreme, you can imagine a single input box on the UI taking the PSK and nothing else, everything else pre-set. if you're making typos all the time, you'll still make typos on this thought experiment's single-input screen, too. In just this single message of yours I'm replying to, I count over a dozen spelling and capitalization errors.

That doesn't count quibbles like wifi vs WiFi, Shelly vs shelly, RouterOS vs RouterOs… I'm talking outright errors like "english", which when lowercased means something different from "English". Computers are literal-minded: case often matters!

It's no wonder you kept getting your PSK wrong so many times in a row.

fanboys who are sooo USLESS in this forum, seen so many topic when those idiots just thinks that every user is god damn RouterOs wizard and knows every possible command...

I truly do agree with this one. This forum could most definitely use a professionalism upgrade, focusing more on helping people rather than belittling them.

Believe it or not, that's what I'm trying to do with this reply: holding up a mirror to the problem. Do you see it now? PEBKAC!

Regardless of whether you think I've succeeded in being helpful, though, I fail to see how even an infinite number of "idiots" and "wizards" on the other side of the Internet are responsible for your repeated WiFi PSK typos.

The Truth Is Out There

Yes, and the truth in this case is that you mistyped your password. Own it.

pe1chl · Wed Feb 02, 2022 11:44 am

MikroTik when logging error "unicast key exchange timeout" - they really mean INCORRECT PASSWORD!

I'm sure it means exactly what it says.

Well, he is right. When you try to connect with an incorrect password, you get "unicast key exchange timeout" on the AP.
That is indeed an error message that could be improved, e.g. "unicast key exchange timeout (likely incorrect password)".

Exactly the same is happening in IPsec PSK, there the router also cannot know why the handshake fails and logs something like that:

phase1 negotiation failed due to time up

but the message has been improved for some cases:

parsing packet failed, possible cause: wrong password

Wed Feb 02, 2022 12:18 pm

Well, he is right. When you try to connect with an incorrect password, you get "unicast key exchange timeout" on the AP.

Yes, I see that in the first post's logs. My point is that this is the "disconnected" message, immediately following the "connected" message. What we need isn't a change to the final state's message but a third message between that says how you get from "connected" to "disconnected."

What we have now is a state diagram with the transition lines left out. While debugging the problem way down at this level is probably not the best way to have diagnosed this issue, it's no wonder the OP was left unenlightened.

bpwl · Wed Feb 02, 2022 12:27 pm

This might explain while people think the extra space at the end of the PSK is causing this. The PSK with extra space is just the wrong PSK. No?
viewtopic.php?t=116480#p844578

dmq · Sun Mar 06, 2022 11:30 am

Happy that you found "your" issue - but unfortunately it is not everytime a layer 8 issue.

viewtopic.php?p=917235#p917235

Just post it here to raise awareness, that it does not always a wrong PSK (maybe the formatting or something similar?).

volkirik · Sat Sep 30, 2023 7:55 pm

On wireless; "indoor" means 150 feet (46 meters) while outdoor means 300 feet. then you set "any" in "Installation".

set wireless-advanced-distance = 1 km instead of indoors or dynamic, then you get higher ACK timeout, but probably less speed.

set on-fail-retry-time=0.1s , set hw-retries=15 , set frame-lifetime=1.6 , set guard-interval and preamble-mode = long ; everything should be OK

set group key update in security profile to 1d. unfortunately best (stable) settings can mean less speed.

note: old (standard) wireless package seems EOL. Try new wifiwave2 package if your devices support it.

volkirik · Thu Oct 05, 2023 7:11 pm

dont forget to disable station-roaming on CPEs; if you dont have multiple APs

you can also use wireless access list (for connection of clients) / wireless connect list (for connection to APs), there you can setup allow-signal-out-of-range for 15 seconds?

bpwl · Thu Oct 05, 2023 9:31 pm

On wireless; "indoor" means 150 feet (46 meters) while outdoor means 300 feet. then you set "any" in "Installation".

I see indoor/outdoor/any under 'installation'.
Then there is indoors/dynamic for the 'Advanced Distance'

AFAIK and experienced, the installation "any/indoor/outdoor" is used as filter for the allowed frequencies for the choosen regulatory domain or country

Like in:

 interface wireless info country-info etsi
 
  ranges: 2402-2482/b,g,gn20,gn40(20dBm)
          5170-5250/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(23dBm)/passive,indoor
          5170-5330/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(20dBm)/dfs,passive,indoor
          5250-5330/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(20dBm)/dfs,passive,indoor
          5490-5710/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(27dBm)/dfs,passive
          5190-5310/a-turbo(20dBm)/dfs
          5180-5300/a-turbo(20dBm)/dfs
          5520-5680/a-turbo(27dBm)/dfs,passive
          5510-5670/a-turbo(27dBm)/dfs,passive
          902-927/b,g,g-turbo,gn20,gn40(30dBm)

E.g.for ETSI/Europe: Some frequencies (from 5180 till 5320) are allowed indoor only (forbidden to be used outdoor).
E.g. for ETSI/Europe : 5500 till 5700 are higher power and not installation limited, so can be used anywhere (outdoor as well as indoor), but they must check for DFS (radar and weather radar detects)

set on-fail-retry-time=0.1s , set hw-retries=15, set frame-lifetime=1.6

Tuning is personal.

,

hw-retries=15 will allow 14 faulty transmissions before the software is informed about the failure. This will hold on the high interface rate somewhat longer, but will step down the interface rate only later (less dynamic behaviour)
set frame-lifetime=1.6 , is normally infinite. wifi does not drop a packet, until it disconnects

For me, first adjusted setting aims at a faster but more unstable wifi connection. The 2nd allows wifi to loose packets.

https://wiki.mikrotik.com/wiki/Manual:Wireless_FAQ

volkirik · Thu Oct 05, 2023 9:52 pm

On wireless; "indoor" means 150 feet (46 meters) while outdoor means 300 feet. then you set "any" in "Installation".
I see indoor/outdoor/any under 'installation'.
Then there is indoors/dynamic for the 'Advanced Distance'

AFAIK and experienced, the installation "any/indoor/outdoor" is used as filter for the allowed frequencies for the choosen regulatory domain or country

Like in:
Code: Select all
 interface wireless info country-info etsi
 
  ranges: 2402-2482/b,g,gn20,gn40(20dBm)
          5170-5250/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(23dBm)/passive,indoor
          5170-5330/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(20dBm)/dfs,passive,indoor
          5250-5330/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(20dBm)/dfs,passive,indoor
          5490-5710/a,an20,an40,ac20,ac40,ac80,ac160,ac80+80(27dBm)/dfs,passive
          5190-5310/a-turbo(20dBm)/dfs
          5180-5300/a-turbo(20dBm)/dfs
          5520-5680/a-turbo(27dBm)/dfs,passive
          5510-5670/a-turbo(27dBm)/dfs,passive
          902-927/b,g,g-turbo,gn20,gn40(30dBm)
E.g.for ETSI/Europe: Some frequencies (from 5180 till 5320) are allowed indoor only (forbidden to be used outdoor).
E.g. for ETSI/Europe : 5500 till 5700 are higher power and not installation limited, so can be used anywhere (outdoor as well as indoor), but they must check for DFS (radar and weather radar detects)

set on-fail-retry-time=0.1s , set hw-retries=15, set frame-lifetime=1.6
Tuning is personal. ,

hw-retries=15 will allow 14 faulty transmissions before the software is informed about the failure. This will hold on the high interface rate somewhat longer, but will step down the interface rate only later (less dynamic behaviour)
set frame-lifetime=1.6 , is normally infinite. wifi does not drop a packet, until it disconnects

For me, first adjusted setting aims at a faster but more unstable wifi connection. The 2nd allows wifi to loose packets.

https://wiki.mikrotik.com/wiki/Manual:Wireless_FAQ

I have read the documentation and the FAQ. I could not understand why would you want to keep packet on the router forever? Do you need packet after several seconds? We do not need them in our networks. Packet drops are not the worst. But, Disconnects are..

If you used simple or interface queues, you will see lots of packet drops and retransmits, which are usual for TCP to tell server/CPE to lower the rate.

Funny enough, if you unset update stats interval, you get ~1 second. but if you are going to set it, 10s is minimum, which is a bug IMHO..

volkirik · Thu Oct 05, 2023 9:56 pm

My WISP friends tell me that use another brand for home setups, for sure..

Maybe thats because you cant set distance between 1-1000 meters? lots of disconnects due to ACK timeout?

I can understand that MT ROS is optimized for PtP long-distance links, but they could simply allow 0.N in distance,, for example 0.1km for 100 meters.

Which is also bug and also feature request. Mikrotik Team should keep improving wireless package, and do not discontinue until all wave1 products are EOL for 7 years. Thats my opinion and I respect others, too.

volkirik · Thu Oct 05, 2023 10:00 pm

And if station roaming means, unlocking from set frequency, and loss of the link, they could disable it altogether on station mode..

I am open to discuss your ideas. What do you think? We disabled it on stations, to be able to solve loss-of-strong-signal.

For example, in mobile (GSM) phones, it can receive signal (guess/observation) from about 32 base stations, without loosing link/lock.? Why wireless chips are not developed for proper roaming? Keep locked frequency working, while you scan other freqs?

bpwl · Thu Oct 05, 2023 10:13 pm

Be aware of the min and max limits on the number and type of characters in SSID and PSK passwords.
These min/max limits and types are more restrictive with Mikrotik than with other brands.

Stick to the brands limitations. Happens everywhere:
Use a password with a "+" at the end of the password with Fortigate, and fail. (FortiOS 2012 version)

bpwl · Thu Oct 05, 2023 10:29 pm

If you used simple or interface queues, you will see lots of packet drops and retransmits, which are usual for TCP to tell server/CPE to lower the rate.

TCP congestion avoidance [Reno, new Reno, Cubic, Compound, ...) and queue rates, and Access List TX/RX rates, are not, and are not related to wifi interface rates (and encodings) (# of chains, HT MCS for 802.11ac, 6 to 54 Mbps per chain for n, VHT MCS for ax)
Wifi interface rates are seen in "Registrations" as [bandwidth MHz/interface rate Mbps/number of S(streams)] , those are not the TX/RX rates of the connection, or the IP rates, but are dynamicly related to the signal strength (SN ratio) and signal quality.
Wifi needs these dynamic rate settings to work in varying conditions. It almost always works, if allowed to adapt.
Normal wifi delivers packets in the correct sequence, unless you don't want/need this and fidle with the settings.

volkirik · Thu Oct 05, 2023 10:35 pm

If you used simple or interface queues, you will see lots of packet drops and retransmits, which are usual for TCP to tell server/CPE to lower the rate.
TCP congestion avoidance [Reno, new Reno, Cubic, Compound, ...) and queue rates, and Access List TX/RX rates, are not, and are not related to wifi interface rates (and encodings) (# of chains, HT MCS for 802.11ac, 6 to 54 Mbps per chain for n, VHT MCS for ax)
Wifi interface rates are seen in "Registrations" as [bandwidth MHz/interface rate Mbps/number of S(streams)] , those are not the TX/RX rates of the connection, or the IP rates, but are dynamicly related to the signal strength (SN ratio) and signal quality.
Wifi needs these dynamic rate settings to work in varying conditions. It almost always works, if allowed to adapt.
Normal wifi delivers packets in the correct sequence, unless you don't want/need this and fidle with the settings.

Yes, wifi rates are dynamic, while queues are static. But you dont want packet with 1.7s delay. Neither your routers cache.

I respect you, thats just my opinion. I may be over-sensitive. I can set 15 seconds which equals maximum disconnect-timeout. But absolutely not zero (infinity)

SEE ALSO: viewtopic.php?p=1029237#p1029237

volkirik · Mon Nov 20, 2023 7:56 pm

when you have virtual wireless interface and wireless security does not match main wireless interface's security,; this bug occurs.

hope this wireless driver bug can be fixed. thanks!

best regards & wishes.

pe1chl · Mon Nov 20, 2023 8:28 pm

What do you mean with "this bug"?

bpwl · Mon Nov 20, 2023 10:57 pm

when you have virtual wireless interface and wireless security does not match main wireless interface's security,; this bug occurs.

hope this wireless driver bug can be fixed. thanks!

best regards & wishes.

Not my experience. I do have many times a RADIUS controlled (EAP secured) wifi interface, where the added virtual wifi interfaces are WPA2/PSK secured. (A lot of devices have no means to handle username based EAP security. So they are given WPA2/PSK secured access)
Be aware of the usual "Access list" settings, to limit the allowed signal range, .... it also sets the security (and VLAN). If not set up carefully, security key can change with the signal strength.

That's how I make all my WPA2/PSK passwords to be MAC address unique. While most interactive connections are Username based.

volkirik · Tue Nov 21, 2023 4:48 am

Try mixing OPEN (none) with WPA2 then.

Thanks & Regards

Maggiore81 · Thu Nov 23, 2023 7:28 am

I solved setting the wpa rekey timeout to 24h.

14 years lasting BUG - disconnected, unicast key exchange timeout

14 years lasting BUG - disconnected, unicast key exchange timeout

Re: 14 years lasting BUG - disconnected, unicast key exchange timeout

Re: 14 years lasting BUG - disconnected, unicast key exchange timeout

Re: 14 years lasting BUG - disconnected, unicast key exchange timeout

Re: 14 years lasting BUG - disconnected, unicast key exchange timeout

Re: 14 years lasting BUG - disconnected, unicast key exchange timeout

Re: 14 years lasting BUG - disconnected, unicast key exchange timeout

Re: 14 years lasting BUG - disconnected, unicast key exchange timeout

Re: 14 years lasting BUG - disconnected, unicast key exchange timeout

Re: 14 years lasting BUG - disconnected, unicast key exchange timeout

Re: 14 years lasting BUG - disconnected, unicast key exchange timeout

Re: 14 years lasting BUG - disconnected, unicast key exchange timeout

Re: 14 years lasting BUG - disconnected, unicast key exchange timeout

Re: 14 years lasting BUG - disconnected, unicast key exchange timeout

Re: 14 years lasting BUG - disconnected, unicast key exchange timeout

Re: 14 years lasting BUG - disconnected, unicast key exchange timeout

Re: 14 years lasting BUG - disconnected, unicast key exchange timeout

Re: 14 years lasting BUG - disconnected, unicast key exchange timeout

Re: 14 years lasting BUG - disconnected, unicast key exchange timeout

Re: 14 years lasting BUG - disconnected, unicast key exchange timeout

Re: 14 years lasting BUG - disconnected, unicast key exchange timeout

Re: 14 years lasting BUG - disconnected, unicast key exchange timeout

Re: 14 years lasting BUG - disconnected, unicast key exchange timeout

Re: 14 years lasting BUG - disconnected, unicast key exchange timeout

Re: 14 years lasting BUG - disconnected, unicast key exchange timeout

Re: 14 years lasting BUG - disconnected, unicast key exchange timeout

Re: 14 years lasting BUG - disconnected, unicast key exchange timeout

Re: 14 years lasting BUG - disconnected, unicast key exchange timeout

Re: 14 years lasting BUG - disconnected, unicast key exchange timeout

Re: 14 years lasting BUG - disconnected, unicast key exchange timeout

Re: 14 years lasting BUG - disconnected, unicast key exchange timeout

Re: 14 years lasting BUG - disconnected, unicast key exchange timeout

Who is online