Station blocked by key handshake fail right before connected (intra roaming) - normal behavior?
Every intra roaming (e.g. 2.4>5GHz) goes like this (log, reverse order):
31 2025-11-05 17:21:29
notice wlan IEEE 802.11
Station: 12:34:56:78:9a:be connected on Channel: 36, SSID: MyWifi, 5GHz, Signal: -66dBm, Interface: wlan-2-1
32 2025-11-05 17:21:28
notice wlan IEEE 802.11
Station: 12:34:56:78:9a:be blocked by key handshake fail on Channel: 36, SSID: MyWifi, 5GHz, Signal: -127dBm, Download/Upload: 0Bytes/0Bytes, reason 2, Interface: wlan-2-1
33 2025-11-05 17:21:28
notice wlan IEEE 802.11
Station: 12:34:56:78:9a:be deauthenticated by key handshake fail
34 2025-11-05 17:21:28
notice wlan IEEE 802.11
Station: 12:34:56:78:9a:be disconnected by Intra Roaming on Channel: 1, SSID: MyWifi, 2.4GHz, Signal: -64dBm, Download/Upload: 46KB/12KB, reason 109, Interface: wlan-1-1
Please, is this normal/expected behavior or is there some roaming misconfiguration etc.? Standalone setup, 802.11k/v enabled on all APs and stations. Roaming from a different AP seems normal:
6 2025-11-06 07:06:51
notice sta-roaming
STA roamed. MAC:12:34:56:78:9A:BE, From: AB:CD:EF:01:23:45, To: AB:CD:EF:01:23:67, SSID:MyWifi
7 2025-11-06 07:06:51
notice wlan IEEE 802.11
Station: 12:34:56:78:9a:be connected on Channel: 36, SSID: MyWifi, 5GHz, Signal: -62dBm, Interface: wlan-2-1
All Replies
-
Hi @mun,
It seems that your client is undergoing unusual intra-roaming behavior. Under normal intra-roaming situations, a client would first establish a connection to the new band (e.g., 5GHz) before disconnecting from the previously connected band (e.g., 2.4GHz).
However, your logs indicate an abnormal pattern:
- Station: 12:34:56:78:9a:be disconnected by Intra Roaming on Channel: 1
- Blocked by key handshake fail
- Deauthenticated by key handshake fail
- Station connected on Channel: 36
This sequence-where handshake failures occur immediately after an intra-roaming disconnect-is not consistent with standard roaming behavior.
Typically, key handshake failures typically occur due to the reasons such as incorrect password, network interference, or insufficient signal strength from the AP.
By examining the log ‘Station: 12:34:56:78:9a:be blocked by key handshake fail on Channel: 36, SSID: MyWifi, 5GHz, Signal: -127dBm’, the signal strength stands out as critically weak. A signal of -127dBm is extremely poor and insufficient for maintaining a stable connection or completing the authentication handshake.
Hence, we can suggest that the handshake failure is most likely caused by insufficient signal strength at the 5GHz AP or the possible RF interference in the environment.
To properly diagnose and resolve this issue, could you please provide the diagnostic report for this AP? This will help us identify whether the problem stems from the weak signal strength of the AP or the other factors.
Thank you for your cooperation.
Best Regards,
Lynn
0 -
Thank you for the reply. I guess the -127dBm value is not a real one when after a second it says -66 dBm. Channel utilization is like 1%. I've tried to collect the diagnostic info but it contained too much sensitive data to post here so I guess I'll just live with it…
0
Categories
- All Categories
- 439 Beta Program
- 2.8K Nebula
- 202 Nebula Ideas
- 127 Nebula Status and Incidents
- 6.3K Security
- 517 USG FLEX H Series
- 328 Security Ideas
- 1.7K Switch
- 84 Switch Ideas
- 1.3K Wireless
- 49 Wireless Ideas
- 6.9K Consumer Product
- 289 Service & License
- 461 News and Release
- 90 Security Advisories
- 31 Education Center
- 10 [Campaign] Zyxel Network Detective
- 4.4K FAQ
- 34 Documents
- 86 About Community
- 97 Security Highlight
Freshman Member
Zyxel Employee