I have a WAX610 for my home WAP (along with a couple Insight switches as well). The last month or two I've had a number of strange issues with the WAP. My router is a pfSense router. When I originally setup the WAP, I setup 2 SSID's. The intention was to make one of the SSID's an "untrusted" VLAN, where it would be allowed out to the internet but not allowed to touch the rest of my home network (outside of a couple of basic firewall rules for really specific things). The issues started after I setup the actual untrusted VLAN about 2 months after all the hardware was setup. It was fine for a bit but after some time it started getting flakey. The interesting thing is it's the "Management" VLAN, the one left essentially "untouched," is the problem.
What's happening is my Pixel 4a 5G will be unable to connect to the "Management" VLAN SSID after being on for a while. If I reboot the phone it'll be able to reconnect. If I connect to the "Untrusted" VLAN SSID then back to the "Management" VLAN SSID it will sometimes connect without needing to reboot. I also notice on my laptop (a Dell XPS 15 9500 running Ubuntu Desktop 20.04) that when on Wifi I will show as connected with a good signal, but randomly I'll stop getting DNS results or there's 5-10 seconds of just waiting for something to start connecting. I have set the phone to not do the whole "random MAC address" thing but it doesn't make a difference.
Everything that connects to the "Untrusted" VLAN SSID is fine. For some needs, connecting to "Untrusted" with my phone or laptop is fine, but as the "Management" VLAN is where all my VM's and stuff live, if I need/want to do certain things I have to connect to "Management." I also know that both VLANs work 100% as expected on ethernet via the switches. All of the issues are limited completely to the Wifi.
I have contacted Netgear support about the issue. One interesting thing they pointed out was that the PoE was likely not providing enough power to the WAP, and luckily I got the WAX610PA with the power adapter so I plugged it in and things actually did get better. They're still happening, but to a lesser extent and with less frequency. I've also done hard resets on the device, and everything is great for ~4 hours then it just creeps back towards instability issues. They agreed with me that it looks like a hardware issue and provided a replacement, yet after setting it up yesterday the issue is now back.
I've been looking at my pfSense VLAN setup, and everything appears good and the fact it's working as expected on ethernet is certainly promising in that regard. I've gone through my settings on the WAP and general Wireless settings, and I can't identify any issues in the configuration that seem likely. What's specifically interesting to me about it is, technically, the Untrusted VLAN SSID has MORE configurations applied to it, such as a MAC filtering ACL and rate limiting, where the Mangement VLAN SSID is as bog-standard of a setup as possible. My theory for the power adapter making things better is that the Untrusted VLAN SSID has far more clients connected to it, so the WAP may have been giving "preference" to that network's stability/ability to connect.
Right now I'm open to any ideas for troubleshooting further. I'm fairly confident I'm looking at a SSID configuration issue, maybe something silly like I have a switch port setup wrong for access/trunking on the VLANs (I've looked thru everything a couple times and it looks fine but I dunno, maybe I'm just missing something). Any ideas for likely culprits?
As I've been looking at my setup more I'm realizing I probably have the VLAN tagging wrong on my switches. I've got an image below showing how everything is tagged for VLAN 50/connected to each other via wiring in my apartment.
netgear28 is in my 12U server rack.
netgear08 is in the patch panel in the bedroom closet in my apartment (weird layout, but I'm working with what I've got). netgear10 is under my TV to connect all the stuff there via ethernet.
netgear28 port 6 connects to netgear08 port 1 via the wall outlet wiring.
netgear08 port 2 connects to netgear10 port 1 via the wall outlet wiring.
netgear08 port 6 connects to the WAP via the wall outlet wiring.
Netgear28 connects to my pfSense router with ports 1-4. Port 1 connects to OPT1 in pfsense, which is what I have VLAN50 (the untrusted VLAN) assigned to. I did that so I can have some easier graphing of what's running over the VLAN. Port 2 is OPT2, currently unused. Port 3 is the pfsense LAN port, and port 4 is that server's IPMI port. My cable modem plugs straight into the 4th NIC (assigned to WAN) on the router.
For VLAN 1 (Management), every port on all the switches are set as access ports. For VLAN 50 (Untrusted), I set it up as pictured below, trunking each of the switch interconnects. I also set a couple access ports on netgear10 and one on netgear28 for ethernet'd devices I'd rather have running on the Untrusted network. I set the port my laptop dock plugs into as a trunked port for VLAN 50 so when I dock my personal laptop it's on VLAN 1, but when I dock my work laptop I can set it's VLAN ID for it's network device to VLAN 50.
I believe my problem may be the fact that VLAN1 is only set as access ports on all ports. I imagine what I need to do is go thru and tag the same ports as trunk ports for VLAN1 as I have on VLAN50, as those ports are essentially just switch interconnects and all switches are potentially carrying both VLANs. I haven't done this yet since, up until recently, everything was working fine and I don't know why it would suddenly start to break.
Could you please share the diagnostic logs from Insight? Mention the MAC address of the devices which you are seeing the issue. Upload the detailed logs into google drive and send me link via PM.
