Community discussions

MikroTik App
 
martinii
just joined
Topic Author
Posts: 24
Joined: Tue Feb 14, 2017 4:14 pm
Location: Poznan, Poland

SA Query timeout

Thu Aug 17, 2023 10:53 pm

Hi all,

I have problem with my father's phone (Samsung A3 2016, stock OS) in my wifi network. I had Mikrotik hAP lite before and there was absolutely no problems! Now I have Mikrotik hAP ax2 and my Dad can't connect to my wifi because of SA Query timeout error. I have few devices (phones, laptops and TV) in my wireless network and there is problem ONLY with this one device... I upgraded router os few times and now i'm on 7.11 stable. I tried Disable PMKID = YES but without success either. Look:
Image

This is part of my configuration:

# 2023-08-17 21:35:25 by RouterOS 7.11
# software id = **ELIDED**
#
# model = C52iG-5HaxD2HaxD
# serial number = XXXXXXXXXXXX
/interface bridge
add name=bridge-LAN
/interface ethernet
set [ find default-name=ether1 ] mac-address=XX:XX:XX:XX:XX:XX
/interface wifiwave2 channel
add band=2ghz-n disabled=no frequency=2447 name=channel-2.4GHz \
    skip-dfs-channels=all width=20mhz
add band=5ghz-ax disabled=no frequency=5280 name=channel-5GHz width=20/40mhz-eC
/interface wifiwave2 security
add authentication-types=wpa2-psk disable-pmkid=yes disabled=no encryption="" \
    name=sec-profile
/interface wifiwave2 configuration
add channel=channel-2.4GHz country=Poland disabled=no mode=ap name=cfg-2.4GHz \
    security=sec-profile ssid=KMPM_nomap
add channel=channel-5GHz country=Poland disabled=no mode=ap name=cfg-5GHz \
    security=sec-profile ssid=KMPM_nomap
/interface wifiwave2
set [ find default-name=wifi2 ] channel=channel-2.4GHz channel.frequency=2447 \
    configuration=cfg-2.4GHz configuration.mode=ap disabled=no name=2.4GHZ
set [ find default-name=wifi1 ] channel=channel-5GHz configuration=cfg-5GHz \
    configuration.mode=ap disabled=no name=5GHz
/ip pool
add name=pool-dhcp ranges=192.168.44.10-192.168.44.35
add name=dhcp_pool1 ranges=192.168.44.2-192.168.44.254
/ip dhcp-server
add address-pool=pool-dhcp insert-queue-before=bottom interface=bridge-LAN \
    lease-time=3d name=dhcp1
/interface bridge port
add bridge=bridge-LAN interface=ether2
add bridge=bridge-LAN interface=ether3
add bridge=bridge-LAN interface=ether4
add bridge=bridge-LAN interface=ether5
add bridge=bridge-LAN interface=5GHz
add bridge=bridge-LAN interface=2.4GHZ
/ip dhcp-server lease
add address=192.168.44.24 client-id=1:a8:9c:ed:4e:b3:ad mac-address=\
    XX:XX:XX:XX:XX:XX server=dhcp1
add address=192.168.44.23 client-id=1:94:be:46:cf:1:76 comment="Tablet Matika" \
    mac-address=XX:XX:XX:XX:XX:XX server=dhcp1
add address=192.168.44.21 client-id=1:78:af:8:80:97:b5 mac-address=\
    XX:XX:XX:XX:XX:XX server=dhcp1
add address=192.168.44.20 client-id=1:20:34:fb:cb:e2:f8 mac-address=\
    XX:XX:XX:XX:XX:XX server=dhcp1
add address=192.168.44.19 client-id=1:8c:c8:cd:59:a2:99 comment="TV SAMSUNG" \
    mac-address=XX:XX:XX:XX:XX:XX server=dhcp1
add address=192.168.44.18 client-id=1:bc:60:a7:cd:db:c5 comment=PS4 \
    mac-address=XX:XX:XX:XX:XX:XX server=dhcp1
/ip dhcp-server network
add address=192.168.44.0/24 gateway=192.168.44.1

Help needed.... :(
Last edited by tangent on Fri Aug 18, 2023 12:16 am, edited 1 time in total.
Reason: export cleanup
 
tangent
Forum Guru
Forum Guru
Posts: 1386
Joined: Thu Jul 01, 2021 3:15 pm
Contact:

Re: SA Query timeout

Fri Aug 18, 2023 12:22 am

I'm terrible at RouterOS WiFi, but a few things in your config raised questions:

1. Why disable PMKID? According to the docs, "Disabling PMKID can cause compatibility issues with client devices which make use of it."

2. encryption=""? Is that just you being over-zealous with the config sanitization, or do you really have all encryption methods disabled?
 
gigabyte091
Forum Guru
Forum Guru
Posts: 1189
Joined: Fri Dec 31, 2021 11:44 am
Location: Croatia

Re: SA Query timeout

Fri Aug 18, 2023 6:29 am

I suggest you to send supout file and log to the support. I had similar problem and i sent them file and log but my AC but problem fixed itself...
 
holvoetn
Forum Guru
Forum Guru
Posts: 5454
Joined: Tue Apr 13, 2021 2:14 am
Location: Belgium

Re: SA Query timeout

Fri Aug 18, 2023 8:24 am

Quick response before leaving for the road trip to France...
2. encryption=""? Is that just you being over-zealous with the config sanitization, or do you really have all encryption methods disabled?
If you use WInbox, make sure that section is folded in.
NOT opened and nothing selected. Is not the same.
 
nescafe2002
Forum Veteran
Forum Veteran
Posts: 897
Joined: Tue Aug 11, 2015 12:46 pm
Location: Netherlands

Re: SA Query timeout

Fri Aug 18, 2023 12:15 pm

Try disabling band steering. I noticed these SA Query Timeout messages just before re-associating with another radio.

https://help.mikrotik.com/docs/display/ ... properties

/interface wifiwave2 configuration set [find] rrm=no wnm=no
 
martinii
just joined
Topic Author
Posts: 24
Joined: Tue Feb 14, 2017 4:14 pm
Location: Poznan, Poland

Re: SA Query timeout

Fri Aug 18, 2023 10:54 pm

I'm terrible at RouterOS WiFi, but a few things in your config raised questions:

1. Why disable PMKID? According to the docs, "Disabling PMKID can cause compatibility issues with client devices which make use of it."

2. encryption=""? Is that just you being over-zealous with the config sanitization, or do you really have all encryption methods disabled?
1. It was only for testing. But without success so returned to default.
2. I missed it out! I had nothing checked indeed... Now i have CCMP and GCMP.
Try disabling band steering. I noticed these SA Query Timeout messages just before re-associating with another radio.

https://help.mikrotik.com/docs/display/ ... properties

/interface wifiwave2 configuration set [find] rrm=no wnm=no
So you suggest to leave only frequencies?
 
İmposss
newbie
Posts: 48
Joined: Sat Jan 16, 2021 5:30 pm

Re: SA Query timeout

Sat Aug 19, 2023 1:01 am

An issue that came with version 7.11. I reverted to version 7.10.2
 
nescafe2002
Forum Veteran
Forum Veteran
Posts: 897
Joined: Tue Aug 11, 2015 12:46 pm
Location: Netherlands

Re: SA Query timeout

Sat Aug 19, 2023 3:16 pm

Try disabling band steering. I noticed these SA Query Timeout messages just before re-associating with another radio.
So you suggest to leave only frequencies?

I suggested to disable band steering, as this was introduced in 7.11:

*) wifiwave2 - added "steering" parameters and menu to set up and monitor AP neighbor groups (CLI only)

An issue that came with version 7.11. I reverted to version 7.10.2

Again, band steering is introduced in 7.11, therefore may be related to these issues.
 
İmposss
newbie
Posts: 48
Joined: Sat Jan 16, 2021 5:30 pm

Re: SA Query timeout

Mon Aug 21, 2023 3:20 am



Try disabling band steering. I noticed these SA Query Timeout messages just before re-associating with another radio.

https://help.mikrotik.com/docs/display/ ... properties

/interface wifiwave2 configuration set [find] rrm=no wnm=no
Hi i tried it doesn't work
/interface wifiwave2 configuration set [find] steering.rrm=no steering.wnm=no
Last edited by İmposss on Mon Aug 28, 2023 7:33 pm, edited 1 time in total.
 
gigabyte091
Forum Guru
Forum Guru
Posts: 1189
Joined: Fri Dec 31, 2021 11:44 am
Location: Croatia

Re: SA Query timeout

Mon Aug 21, 2023 6:41 am

Did you try to contact Mikrotik support ? At this point they maybe can help you more.
 
martinii
just joined
Topic Author
Posts: 24
Joined: Tue Feb 14, 2017 4:14 pm
Location: Poznan, Poland

Re: SA Query timeout

Mon Aug 28, 2023 6:47 pm

I tried disable steering but no luck... Well I feel it doesn't matter what I do - it always doesn't work... On hAP ac lite no problems, on ax2 it still doesn't work...
 
holvoetn
Forum Guru
Forum Guru
Posts: 5454
Joined: Tue Apr 13, 2021 2:14 am
Location: Belgium

Re: SA Query timeout

Mon Aug 28, 2023 7:31 pm

Did you try to contact Mikrotik support ? At this point they maybe can help you more.
Best recommendation to get... create supout.rif, contact support.
 
İmposss
newbie
Posts: 48
Joined: Sat Jan 16, 2021 5:30 pm

Re: SA Query timeout

Mon Aug 28, 2023 7:34 pm

Did you try to contact Mikrotik support ? At this point they maybe can help you more.
Best recommendation to get... create supout.rif, contact support.
I did, waiting for support
 
maigonis
Member Candidate
Member Candidate
Posts: 184
Joined: Sat Jul 20, 2019 8:16 pm

Re: SA Query timeout

Tue Aug 29, 2023 1:44 am

Try WPA2 only to isolate issue to security settings.
 
martinii
just joined
Topic Author
Posts: 24
Joined: Tue Feb 14, 2017 4:14 pm
Location: Poznan, Poland

Re: SA Query timeout

Tue Aug 29, 2023 10:47 am

I tried WPA2 only. As well as firmware upgrading, disabling band steering, disabling PMKID, turning off encription, disabling 5GHz radio and rebooting donzens times....
 
Rox169
Member
Member
Posts: 434
Joined: Sat Sep 04, 2021 1:47 am

Re: SA Query timeout

Tue Aug 29, 2023 11:04 am

did you tried to delete/forget the network in mobile and do new connect???
 
martinii
just joined
Topic Author
Posts: 24
Joined: Tue Feb 14, 2017 4:14 pm
Location: Poznan, Poland

Re: SA Query timeout

Tue Aug 29, 2023 2:00 pm

Every time when I made some changes in router settings.
 
İmposss
newbie
Posts: 48
Joined: Sat Jan 16, 2021 5:30 pm

Re: SA Query timeout

Fri Sep 01, 2023 4:02 pm

solution for me:
/interface/wifiwave2/configuration> set [find] security.connect-priority=0/1
 
alibloke
Frequent Visitor
Frequent Visitor
Posts: 51
Joined: Fri Jun 03, 2016 12:13 am

Re: SA Query timeout

Mon Sep 25, 2023 10:12 am

This appears to work, my laptop has been able to fast roam for the first time and the dreaded SA Query Timeout message is gone. I must admit I don't understand why and I'm concerned that it's working at the cost of security, specifically MacStealer attacks as per this post:
viewtopic.php?t=198228#p1016424

Can anyone elaborate on what this setting actually does?
 
ToTheFull
Member Candidate
Member Candidate
Posts: 239
Joined: Fri Mar 24, 2023 3:24 pm

Re: SA Query timeout

Mon Sep 25, 2023 1:01 pm

solution for me:
/interface/wifiwave2/configuration> set [find] security.connect-priority=0/1
This appears to work, my laptop has been able to fast roam for the first time and the dreaded SA Query Timeout message is gone. I must admit I don't understand why and I'm concerned that it's working at the cost of security, specifically MacStealer attacks as per this post:
viewtopic.php?t=198228#p1016424

Can anyone elaborate on what this setting actually does?
Yes please do, tired of this in my logs all the time when someone walks into the kitchen.
/log print where message~"C6"
 09-22 12:24:54 wireless,info C6:6B:0C@wifi1 connected, signal strength -61
 09-22 12:26:44 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -73
 09-22 12:26:44 wireless,info C6:6B:0C@wifi1 connected, signal strength -75
 09-22 12:27:26 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -68
 09-22 12:27:27 wireless,info C6:6B:0C@wifi1 connected, signal strength -71
 09-22 12:27:55 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -69
 09-22 12:27:55 wireless,info C6:6B:0C@wifi1 connected, signal strength -71
 09-22 12:29:58 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -68
 09-22 12:30:22 wireless,info C6:6B:0C@wifi1 connected, signal strength -68
 09-22 12:31:44 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -71
 09-22 12:31:55 dhcp,info defconf deassigned 192.168.0.106 for C6:6B:0C
 09-22 12:31:56 dhcp,info defconf assigned 192.168.0.106 for C6:6B:0C 
 09-22 12:31:58 wireless,info C6:6B:0C@wifi1 connected, signal strength -71
 09-22 12:32:24 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -73
 09-22 12:32:24 wireless,info C6:6B:0C@wifi1 connected, signal strength -75
 09-22 12:32:33 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -72
 09-22 12:32:34 wireless,info C6:6B:0C@wifi1 connected, signal strength -75
 09-22 12:32:38 dhcp,info defconf deassigned 192.168.0.106 for C6:6B:0C 
 09-22 12:32:39 dhcp,info defconf assigned 192.168.0.106 for C6:6B:0C 
 09-22 12:32:49 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -70
 09-22 12:32:50 wireless,info C6:6B:0C@wifi1 connected, signal strength -73
 09-22 12:34:18 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -77
 09-22 12:34:19 wireless,info C6:6B:0C@wifi1 connected, signal strength -76
 09-22 12:38:17 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -71
 09-22 12:38:17 wireless,info C6:6B:0C@wifi1 connected, signal strength -70
 09-22 12:42:13 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -70
 09-22 12:42:20 wireless,info C6:6B:0C@wifi1 connected, signal strength -65
 09-22 12:47:26 wireless,info C6:6B:0C@wifi1 disconnected, connection lost, signal strength -64
 09-22 14:48:23 wireless,info C6:6B:0C@wifi1 connected, signal strength -62
 09-22 14:55:07 wireless,info C6:6B:0C@wifi1 disconnected, connection lost, signal strength -68
 09-22 16:47:44 wireless,info C6:6B:0C@wifi1 connected, signal strength -62
 09-22 16:52:48 wireless,info C6:6B:0C@wifi1 disconnected, connection lost, signal strength -72
 09-22 17:00:05 wireless,info C6:6B:0C@wifi1 connected, signal strength -68
 09-22 17:01:09 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -58
 09-22 17:01:10 wireless,info C6:6B:0C@wifi1 connected, signal strength -66
 09-22 17:01:36 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -71
 09-22 17:01:37 wireless,info C6:6B:0C@wifi1 connected, signal strength -67
 09-22 17:01:53 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -70
 09-22 17:01:59 wireless,info C6:6B:0C@wifi1 connected, signal strength -66
 09-22 17:45:29 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -67
 09-22 17:45:29 wireless,info C6:6B:0C@wifi1 connected, signal strength -68
 09-22 17:51:25 wireless,info C6:6B:0C@wifi1 disconnected, connection lost, signal strength -70
 09-22 19:00:20 wireless,info C6:6B:0C@wifi1 connected, signal strength -63
 09-22 19:06:08 wireless,info C6:6B:0C@wifi1 disconnected, connection lost, signal strength -85
 09-22 22:43:48 wireless,info C6:6B:0C@wifi1 connected, signal strength -52
 09-22 22:44:39 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -66
 09-22 22:44:40 wireless,info C6:6B:0C@wifi1 connected, signal strength -65
 09-22 22:45:01 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -62
 09-22 22:45:01 wireless,info C6:6B:0C@wifi1 connected, signal strength -68
 09-22 22:45:11 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -68
 09-22 22:45:12 wireless,info C6:6B:0C@wifi1 connected, signal strength -67
 09-22 22:51:14 wireless,info C6:6B:0C@wifi1 disconnected, connection lost, signal strength -78
 09-23 11:06:06 wireless,info C6:6B:0C@wifi1 connected, signal strength -70
 09-23 11:09:13 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -66
 09-23 11:09:14 wireless,info C6:6B:0C@wifi1 connected, signal strength -70
 09-23 11:12:12 wireless,info C6:6B:0C@wifi1 disconnected, group key timeout, signal strength -74
 09-23 11:14:23 wireless,info C6:6B:0C@wifi1 connected, signal strength -73
 09-23 11:21:47 wireless,info C6:6B:0C@wifi1 disconnected, connection lost, signal strength -87
 09-23 11:42:52 wireless,info C6:6B:0C@wifi1 connected, signal strength -59
 09-23 11:48:11 wireless,info C6:6B:0C@wifi1 disconnected, connection lost, signal strength -79
 09-23 15:59:09 wireless,info C6:6B:0C@wifi1 connected, signal strength -66
 09-23 16:08:07 wireless,info C6:6B:0C@wifi1 disconnected, connection lost, signal strength -74
 09-23 19:31:54 wireless,info C6:6B:0C@wifi1 connected, signal strength -60
 09-23 19:37:45 wireless,info C6:6B:0C@wifi1 disconnected, connection lost, signal strength -72
 09-23 23:46:56 wireless,info C6:6B:0C@wifi1 connected, signal strength -68
 09-23 23:51:58 wireless,info C6:6B:0C@wifi1 disconnected, connection lost, signal strength -69
 09-24 10:49:40 wireless,info C6:6B:0C@wifi1 connected, signal strength -67
 09-24 10:55:48 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -73
 09-24 10:56:45 wireless,info C6:6B:0C@wifi1 connected, signal strength -68
 09-24 11:07:30 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -73
 09-24 11:07:30 wireless,info C6:6B:0C@wifi1 connected, signal strength -74
 09-24 11:12:18 wireless,info C6:6B:0C@wifi1 disconnected, group key timeout, signal strength -72
 09-24 11:49:45 wireless,info C6:6B:0C@wifi1 connected, signal strength -70
 09-24 11:51:22 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -72
 09-24 11:51:22 wireless,info C6:6B:0C@wifi1 connected, signal strength -70
 09-24 11:52:27 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -65
 09-24 11:52:27 wireless,info C6:6B:0C@wifi1 connected, signal strength -55
 09-24 11:58:33 wireless,info C6:6B:0C@wifi1 disconnected, connection lost, signal strength -86
 09-24 12:23:19 wireless,info C6:6B:0C@wifi1 connected, signal strength -67
 09-24 12:23:54 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -69
 09-24 12:23:54 wireless,info C6:6B:0C@wifi1 connected, signal strength -71
 09-24 12:23:58 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -71
 09-24 12:23:59 wireless,info C6:6B:0C@wifi1 connected, signal strength -69
 09-24 12:26:16 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -69
 09-24 12:26:17 wireless,info C6:6B:0C@wifi1 connected, signal strength -71
 09-24 12:29:21 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -71
 09-24 12:29:22 wireless,info C6:6B:0C@wifi1 connected, signal strength -72
 09-24 12:36:25 wireless,info C6:6B:0C@wifi1 disconnected, connection lost, signal strength -70
 09-24 14:46:34 wireless,info C6:6B:0C@wifi1 connected, signal strength -57
 09-24 14:52:05 wireless,info C6:6B:0C@wifi1 disconnected, connection lost, signal strength -71
 09-24 17:37:33 wireless,info C6:6B:0C@wifi1 connected, signal strength -67
 09-24 17:37:37 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -70
 09-24 17:37:37 wireless,info C6:6B:0C@wifi1 connected, signal strength -75
 09-24 18:05:15 wireless,info C6:6B:0C@wifi1 disconnected, connection lost, signal strength -82
 09-24 18:28:54 wireless,info C6:6B:0C@wifi1 connected, signal strength -56
 09-24 18:34:35 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -72
 09-24 18:34:35 wireless,info C6:6B:0C@wifi1 connected, signal strength -74
 09-24 18:36:03 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -74
 09-24 18:36:03 wireless,info C6:6B:0C@wifi1 connected, signal strength -71
 09-24 18:40:44 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -68
 09-24 18:40:44 wireless,info C6:6B:0C@wifi1 connected, signal strength -69
 09-24 18:41:10 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -73
 09-24 18:41:10 wireless,info C6:6B:0C@wifi1 connected, signal strength -70
 09-24 18:41:13 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -69
 09-24 18:41:14 wireless,info C6:6B:0C@wifi1 connected, signal strength -71
 09-24 18:42:59 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -69
 09-24 18:42:59 wireless,info C6:6B:0C@wifi1 connected, signal strength -69
 09-24 18:45:31 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -68
 09-24 18:45:32 wireless,info C6:6B:0C@wifi1 connected, signal strength -71
 09-24 18:47:16 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -74
 09-24 18:47:17 wireless,info C6:6B:0C@wifi1 connected, signal strength -68
 09-24 18:48:03 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -76
 09-24 18:48:03 wireless,info C6:6B:0C@wifi1 connected, signal strength -72
 09-24 18:50:56 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -69
 09-24 18:50:56 wireless,info C6:6B:0C@wifi1 connected, signal strength -68
 09-24 18:57:22 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -67
 09-24 18:57:23 wireless,info C6:6B:0C@wifi1 connected, signal strength -68
 09-24 18:58:50 wireless,info C6:6B:0Cwifi1 disconnected, SA Query timeout, signal strength -69
 09-24 18:58:51 wireless,info C6:6B:0C@wifi1 connected, signal strength -69
 09-24 19:04:56 wireless,info C6:6B:0C@wifi1 disconnected, connection lost, signal strength -70
 09:20:40 wireless,info C6:6B:0C@wifi1 connected, signal strength -66
 09:23:00 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -71
 09:23:00 wireless,info C6:6B:0C@wifi1 connected, signal strength -69
 09:25:21 wireless,info C6:6B:0C@wifi1 disconnected, SA Query timeout, signal strength -72
 09:25:21 wireless,info C6:6B:0C@wifi1 connected, signal strength -72
 
brg3466
Member Candidate
Member Candidate
Posts: 177
Joined: Sat Aug 01, 2015 7:29 am

Re: SA Query timeout

Thu Sep 28, 2023 5:17 am

anyone has solution ?

It is weird that in our house, only iPhone14 pro has this "SA query timeout" issue. All other apple devices ( macbook, macbook air, ipad or iphone 12) don't behave like this.
 
martinii
just joined
Topic Author
Posts: 24
Joined: Tue Feb 14, 2017 4:14 pm
Location: Poznan, Poland

Re: SA Query timeout

Mon Oct 02, 2023 4:38 pm

In my case it still doesn't work... The only solution I can see is to give my Dad a new phone.
 
Santi70
Frequent Visitor
Frequent Visitor
Posts: 57
Joined: Mon Sep 07, 2020 12:35 am

Re: SA Query timeout

Fri Nov 17, 2023 2:10 pm

I also have that problem, but only with an iPhone 13, all other devices work fine
 
jugernautas
just joined
Posts: 1
Joined: Thu Dec 07, 2023 4:06 pm

Re: SA Query timeout

Thu Dec 07, 2023 4:18 pm

Hello,
First time here. I have upgraded my cAP ax device from v7.8 to v7.12 and one "Lenovo" laptop started disconnecting often.
Looking at the log I have determined that the problem could be that laptop changes wifi frequencies from 5Ghz to 2Ghz and therefore cAP device waits until it can no longer determine that laptop is connected. After then it lets connect to AP. The duration time offline was about 1 minute.
I could not find any sophisticated information, so I tried changing these 2 values on each frequency radio interface:

connect-group ( string )

APs within the same connect group do not allow more than 1 client device with the same MAC address. This is to prevent malicious authorized users from intercepting traffic intended to other users ('MacStealer' attack) or performing a denial of service attack by spoofing the MAC address of a victim.

Handling of new connections with duplicate MAC addresses depends on the connect-priority of AP interfaces involved.

By default, all APs are assigned the same connect-group.


connect-priority (accept-priority/hold-priority (integers))

Theese parameters determine, how a connection is handled if the MAC address of the client device is the same as that of another active connection to another AP.
If (accept-priority of AP2) < (hold-priority of AP1), a connection to AP2 wil cause the client to be dropped from AP1.
If (accept-priority of AP2) = (hold-priority of AP1), a connection to AP2 will be allowed only if the MAC address can no longer be reached via AP1.
If (accept-priority of AP2) > (hold-priority of AP1), a connection to AP2 will not be accepted.

If omitted, hold-priority is the same as accept-priority.
By default, APs, which perform user authentication, have higher priority (lower integer value), than open APs.

Image


Image


On 2Ghz - Security - Connect Group ("Grupe2") and Connect Priority (0/1)
On 5Ghz - Security - Connect Group ("Grupe5") and Connect Priority (0/1)

For now the laptop works ok, no long disconnections from Wifi. It would be great if someone can explain if this is right way to configure it.
Last edited by jugernautas on Thu Dec 07, 2023 4:39 pm, edited 4 times in total.
 
tinodj
newbie
Posts: 25
Joined: Fri Oct 05, 2018 4:04 pm

Re: SA Query timeout

Tue Jan 16, 2024 9:28 am

Hit this problem after upgrading from 6 to 7. Was very stable with 6, now on ROS7 is frustrating with this. Happens on iPhone and Mac. Happens on cAP ax and Audience. Solutions here didn’t help :( Have anyone found something else?
 
kurio
newbie
Posts: 25
Joined: Sun Dec 22, 2013 6:15 pm

Re: SA Query timeout

Fri Jan 19, 2024 11:05 am

Hit this problem after upgrading from 6 to 7. Was very stable with 6, now on ROS7 is frustrating with this. Happens on iPhone and Mac. Happens on cAP ax and Audience. Solutions here didn’t help :( Have anyone found something else?
Hello,
Started having this problem with i don't know which version of ROS 7.xx, now running the latest 7.13.2.
Impossible to roam from independent AX2 to AX3: simple connects/disconnects, SA timeouts, no IPv4 DHCP replies, all kinds of crap.
I have tried all the suggestions here and there, but they do not work. All smartphones are android, most of them have issues staying connected when moving from floor to floor (from one hap ax to another).
However, i have noticed a workaround which works on some phones: instead of static phone MAC address switch to randomized MAS addresses.
Is this whole issue is related to the client MAC addresses?
Do i need to configure and run capsman to overcome this critical connectivity problem?
 
ToTheFull
Member Candidate
Member Candidate
Posts: 239
Joined: Fri Mar 24, 2023 3:24 pm

Re: SA Query timeout

Fri Jan 19, 2024 12:31 pm

CAPsMAN wont help, also the same on 7.14Beta7 maybe slightly worse than 7.14Beta6.
Anyway, I'm sure someone will be along soon to say it's your config etc...........
 
erlinden
Forum Guru
Forum Guru
Posts: 1953
Joined: Wed Jun 12, 2013 1:59 pm
Location: Netherlands

Re: SA Query timeout

Fri Jan 19, 2024 2:52 pm

Anyway, I'm sure someone will be along soon to say it's your config etc...........
How do you know his config is correct. There are not a lot of topics where, after sharing the config, there are no improvements to make on the config.

@kurio: As far as I know the client will always use the same MAC address (per SSID), even if it is randomized. No clue why you think it is helping...

In regards to the SA Query timeout problem, it has been solved for me (using CAPsMAN) by setting the connect-priority.
 
User avatar
masseselsev
just joined
Posts: 11
Joined: Thu Mar 27, 2014 8:01 am
Location: Somewhere around the globe

Re: SA Query timeout

Fri Jan 19, 2024 2:54 pm

Same here on Chateau 18 (7.13.2) with all my AX diveces that are trying to connect to 2Ghz, 5Ghz connections are fine though.
No CAPsMAN, just a single(dual actually) raido.
The devices namely are a couple of Google pixel (6&7) phones, and a pair of laptops with AX211 wifis'.
Also, the devices that are not capable of AX seem to de working just fine,
And it happens randomly -- not all the devices at once.

Maybe the matter does deserve some comment from the staff?

edit. persuaded a part of the devices to connect to 5g only, now this happens both with 2 and 5 ghz (((
Last edited by masseselsev on Sat Jan 20, 2024 11:20 am, edited 2 times in total.
 
holvoetn
Forum Guru
Forum Guru
Posts: 5454
Joined: Tue Apr 13, 2021 2:14 am
Location: Belgium

Re: SA Query timeout

Fri Jan 19, 2024 2:57 pm

Then it might be better to create a ticket with supout right after you see it happening.
Because staff does not frequent these forums that often (they sometimes do).
 
ToTheFull
Member Candidate
Member Candidate
Posts: 239
Joined: Fri Mar 24, 2023 3:24 pm

Re: SA Query timeout

Fri Jan 19, 2024 3:56 pm

Anyway, I'm sure someone will be along soon to say it's your config etc...........
In regards to the SA Query timeout problem, it has been solved for me (using CAPsMAN) by setting the connect-priority.

Deployed... i'll let YOU Know!
2 name="wifi1" l2mtu=1560 mac-address=18:FD arp-timeout=auto radio-mac=18:FD
   configuration.mode=ap .ssid="002" .country=United Kingdom 
   security.authentication-types=wpa2-psk .encryption=ccmp .passphrase="" 
   .management-protection=allowed .wps=disable .connect-priority=0/1 
   channel.frequency=5180 .band=5ghz-ax .width=20/40/80mhz .skip-dfs-channels=10min-cac
If that isn't correct please do share what needs to be done.
 
fronik
just joined
Posts: 3
Joined: Tue Jun 30, 2015 10:28 pm

Re: SA Query timeout

Thu Feb 29, 2024 7:27 pm

Faced the same problem
disconnected, SA Query timeout
On 5Ghz - Security - Connect Priority (0/1) It worked until firmware 7.14, but on 7.14 the network on the laptop began to fall off constantly. Connected \ Disconnected...

back to 7.13.4 (and definitely System\RouterBOARD\Upgrade firmware to 7.13.4) - good work for me
 
Neolo
just joined
Posts: 12
Joined: Mon Aug 26, 2019 12:24 pm

Re: SA Query timeout

Sat Mar 02, 2024 2:18 am

Faced the same problem
disconnected, SA Query timeout
On 5Ghz - Security - Connect Priority (0/1) It worked until firmware 7.14, but on 7.14 the network on the laptop began to fall off constantly. Connected \ Disconnected...

back to 7.13.4 (and definitely System\RouterBOARD\Upgrade firmware to 7.13.4) - good work for me
Priority does not do anything, 7.14. Log is flooded with SA Query timeouts. Clients have terrible experience using wifi. What is going on??
 
User avatar
Kanzler
newbie
Posts: 35
Joined: Wed Oct 05, 2022 6:55 pm
Location: Ukraine

Re: SA Query timeout

Sat Mar 02, 2024 7:56 am

@Neolo,
Could you please show your configuration?
 
fronik
just joined
Posts: 3
Joined: Tue Jun 30, 2015 10:28 pm

Re: SA Query timeout

Sat Mar 02, 2024 4:54 pm

RouterOS and firmware ver <= 7.13.4 - normal work
RouterOS and firmware ver = 7.14 - clients disconnected and logs: "... disconnected, SA Query timeout ..."
My config:
/interface wifi configuration

add channel.band=2ghz-ax .frequency=2412 .skip-dfs-channels=10min-cac .width=20mhz country=Russia datapath.bridge=bridge disabled=no mode=ap name=2Ghz security.authentication-types=wpa2-psk,wpa3-psk .connect-priority=0/1 .passphrase=WiFiPass124 .wps=disable ssid=WiFiName123

add channel.band=5ghz-ax .frequency=5640-5725 .skip-dfs-channels=10min-cac .width=20/40/80mhz country=Russia datapath.bridge=bridge disabled=no mode=ap name=5Ghz security.authentication-types=wpa2-psk,wpa3-psk .connect-priority=0/1 .passphrase=WiFiPass124 .wps=disable ssid=WiFiName123-5GHz

/interface wifi cap
set caps-man-addresses=127.0.0.1 enabled=yes

/interface wifi capsman
set enabled=yes package-path="" require-peer-certificate=no upgrade-policy=none

/interface wifi provisioning
add action=create-dynamic-enabled disabled=no master-configuration=2Ghz supported-bands=2ghz-ax
add action=create-dynamic-enabled disabled=no master-configuration=5Ghz supported-bands=5ghz-ax

My clients: phones, tv, ps5, smarthome devices notebooks
 
MaxwellsEq
newbie
Posts: 33
Joined: Mon Apr 05, 2021 11:13 pm

Re: SA Query timeout

Sun Mar 03, 2024 1:02 am

I didn't see any mention of disabling Frame Protection. Did this not have any effect?
 
Neolo
just joined
Posts: 12
Joined: Mon Aug 26, 2019 12:24 pm

Re: SA Query timeout

Sun Mar 03, 2024 4:37 am

@Neolo,
Could you please show your configuration?
Which configuration are you asking about?
Everything is default except for it's an open network with OWE enabled.
 
Neolo
just joined
Posts: 12
Joined: Mon Aug 26, 2019 12:24 pm

Re: SA Query timeout

Sun Mar 03, 2024 4:38 am

I didn't see any mention of disabling Frame Protection. Did this not have any effect?
The only effect it makes is rendering WPA3 and OWE inoperable. And I don't want that.
 
Neolo
just joined
Posts: 12
Joined: Mon Aug 26, 2019 12:24 pm

Re: SA Query timeout

Sun Mar 03, 2024 4:42 am

RouterOS and firmware ver <= 7.13.4 - normal work
No it wasn't. I just upgraded from 7.13.4 to 7.14, both have the same problem. Trust me, I have a public place to test with 200 people connecting, not just own laptop and a phone.
 
User avatar
Kanzler
newbie
Posts: 35
Joined: Wed Oct 05, 2022 6:55 pm
Location: Ukraine

Re: SA Query timeout

Sun Mar 03, 2024 7:51 am

@Neolo
Very strange, I don't experience such an issue myself. Have you tried enabling FT? Maybe that will help?
 
MaxwellsEq
newbie
Posts: 33
Joined: Mon Apr 05, 2021 11:13 pm

Re: SA Query timeout

Sun Mar 03, 2024 9:53 am

I didn't see any mention of disabling Frame Protection. Did this not have any effect?
The only effect it makes is rendering WPA3 and OWE inoperable. And I don't want that.
Lots of non-compute devices (TVs, cameras, doorbells etc.) which don't support Frame Protection also don't seem to properly ignore its presence. If you Google SA Query Timeout, you will find this also an issue with non-Mikrotik Wireless setups. We seem to have two choices, only have very modern non-compute devices (fully WPA3 compliant) or run a Wireless radio setup which has no WPA3 elements including Frame Protection (with the small security risk this implies).
 
ToTheFull
Member Candidate
Member Candidate
Posts: 239
Joined: Fri Mar 24, 2023 3:24 pm

Re: SA Query timeout

Sun Mar 03, 2024 10:59 am

SNIP: Trust me, I have a public place to test with 200 people connecting, not just own laptop and a phone.
From my point of view that would look painfull on the eyes.
I have tried the "Connect Priority 0/1" trick and although it seems to help (not cure) it causes unexplained speed drops on both my AX devices.
 
Neolo
just joined
Posts: 12
Joined: Mon Aug 26, 2019 12:24 pm

Re: SA Query timeout

Sun Mar 03, 2024 10:34 pm

SNIP: Trust me, I have a public place to test with 200 people connecting, not just own laptop and a phone.
From my point of view that would look painfull on the eyes.
I have tried the "Connect Priority 0/1" trick and although it seems to help (not cure) it causes unexplained speed drops on both my AX devices.
I have that priority in place, it makes zero effect, timeouts still written in log.
 
Neolo
just joined
Posts: 12
Joined: Mon Aug 26, 2019 12:24 pm

Re: SA Query timeout

Sun Mar 03, 2024 10:35 pm

@Neolo
Very strange, I don't experience such an issue myself. Have you tried enabling FT? Maybe that will help?
What's FT?
 
Neolo
just joined
Posts: 12
Joined: Mon Aug 26, 2019 12:24 pm

Re: SA Query timeout

Sun Mar 03, 2024 10:38 pm


The only effect it makes is rendering WPA3 and OWE inoperable. And I don't want that.
Lots of non-compute devices (TVs, cameras, doorbells etc.) which don't support Frame Protection also don't seem to properly ignore its presence. If you Google SA Query Timeout, you will find this also an issue with non-Mikrotik Wireless setups. We seem to have two choices, only have very modern non-compute devices (fully WPA3 compliant) or run a Wireless radio setup which has no WPA3 elements including Frame Protection (with the small security risk this implies).
Nope, in the environment I have there is no TVs or doorbells, but phones and tablets.
Mikrotik should fix the firmware to accommodate all models properly, it's all it is.
 
User avatar
Kanzler
newbie
Posts: 35
Joined: Wed Oct 05, 2022 6:55 pm
Location: Ukraine

Re: SA Query timeout

Sun Mar 03, 2024 10:44 pm

set ft=yes and ft-over-ds=yes in security profile to enable 802.11r fast BSS transitions (roaming)
 
tangent
Forum Guru
Forum Guru
Posts: 1386
Joined: Thu Jul 01, 2021 3:15 pm
Contact:

Re: SA Query timeout

Mon Mar 04, 2024 12:33 am

What's FT?

Fast Transitions, a recently added feature. Disabled by default. “FT” is the tab name in WinBox.
 
Neolo
just joined
Posts: 12
Joined: Mon Aug 26, 2019 12:24 pm

Re: SA Query timeout

Tue Mar 05, 2024 9:15 pm

What's FT?

Fast Transitions, a recently added feature. Disabled by default. “FT” is the tab name in WinBox.
I have enabled it in my security template, but it doesn't do anything about SA Query timeouts alone.
However, when I have connected all APs via Capsman and enabled FT and FT over DS, that seems stopped SA Query Timeout errors.
 
User avatar
robmaltsystems
Long time Member
Long time Member
Posts: 574
Joined: Fri Jun 21, 2019 12:04 pm

Re: SA Query timeout

Sun Apr 07, 2024 11:32 pm

solution for me:
/interface/wifiwave2/configuration> set [find] security.connect-priority=0/1
How do you query this setting? /interface/wifi/configuration/print doesn't show anything. It doesn't appear in /export either.
 
ToTheFull
Member Candidate
Member Candidate
Posts: 239
Joined: Fri Mar 24, 2023 3:24 pm

Re: SA Query timeout

Sun Apr 07, 2024 11:35 pm

I think they added it to this, if thats what you mean?
interface/wifi/monitor 0,1,2,3
                 state: running        running   running        running
               channel: 5500/ax/Ceee   2412/ax   5180/ax/Ceee   2462/ax
      registered-peers: 3              0         1              2
      authorized-peers: 3              0         1              2
              tx-power: 22             14        18             15
    channel-priorities: 0:5500/ax/Ceee 0:2412/ax 0:5180/ax/Ceee 0:2462/ax
 
User avatar
chechito
Forum Guru
Forum Guru
Posts: 3005
Joined: Sun Aug 24, 2014 3:14 am
Location: Bogota Colombia
Contact:

Re: SA Query timeout

Sun Apr 07, 2024 11:46 pm

try this security settings for compatibility
security.authentication-types=wpa2-psk .disable-pmkid=yes .encryption=ccmp .group-encryption=ccmp .group-key-update=1d .passphrase=xxxxxxxxxxxx .wps=disable

PD: i dont have any ax device for testing, this config i use it on hap-ac2 and audience, with routeros 7.13.5 and 7.14.2 working ok
 
User avatar
robmaltsystems
Long time Member
Long time Member
Posts: 574
Joined: Fri Jun 21, 2019 12:04 pm

Re: SA Query timeout

Mon Apr 08, 2024 12:07 am

Thanks, will do but another time - it's late in UK and I've spent more hours than I really wanted to on this.
 
infabo
Long time Member
Long time Member
Posts: 669
Joined: Thu Nov 12, 2020 12:07 pm

Re: SA Query timeout

Mon Apr 08, 2024 12:22 am

try this security settings for compatibility
security.authentication-types=wpa2-psk .disable-pmkid=yes .encryption=ccmp .group-encryption=ccmp .group-key-update=1d .passphrase=xxxxxxxxxxxx .wps=disable

PD: i dont have any ax device for testing, this config i use it on hap-ac2 and audience, with routeros 7.13.5 and 7.14.2 working ok
I'll go through docs:
.encryption=ccmp .group-encryption=ccmp .group-key-update=1d
That's already the defaults.
disable-pmkid=yes
If unsure this rather lowers compatibility.
wps=disable
Sure, good idea. But I think this not increase/decrease compatibility.
 
User avatar
robmaltsystems
Long time Member
Long time Member
Posts: 574
Joined: Fri Jun 21, 2019 12:04 pm

Re: SA Query timeout

Mon Apr 08, 2024 3:45 pm

I'm going to do some more reading up on this before I start making any changes.

For the record, the device I'm having trouble with is an Lenovo V15 G2-ALC laptop, Windows 10, Realtek 882CE 802.11ac wireless chip. Using WPA2/3 authentication with defaults for everything else. Not tried the FT switches yet or any other tweaks.

Connects fine with no SA Query timeout errors in the log when sat on the coffee table about 1.5m away. Move it onto the bench about 3m away and unable to connect to 5GHz with SA Query Timeout in log. There is a partial 20m stone wall in the way and often me :-)

When 1.5m from the hAP ax2, the router reports signal strength -54. The laptop reports a signal strength of -37. That -54 is "interesting", i.e. it being so low - suggests poor signal from the laptop? Connected to timeout errors? Never had any problem with old Virgin Media router.

I bought a cheap Wi-Fi 6 USB adapter for testing purposes. Signal strengths are -44 at router and -47 on laptop. When using this, it also works fine on the bench.

The SA query time errors occur both with WPA2 and WPA3. I thought it was a WPA3 "thing" but clearly not hence the reason for wanting to read up more.
 
User avatar
robmaltsystems
Long time Member
Long time Member
Posts: 574
Joined: Fri Jun 21, 2019 12:04 pm

Re: SA Query timeout

Mon Apr 08, 2024 4:39 pm

I left the laptop on the coffee table, connected to 5GHz using the Wi-Fi 6 USB network adapter and came back about an hour later and it too had got SA Query timeout errors and had fallen back to 2.4GHz:

Image

Something isn't right here. This is sat 1.5m from the router with very little else going on. I've restarted the adapter and it's reconnected at 5GHz...

Image

Who is online

Users browsing this forum: uamma and 6 guests