Going nuts with Orbi 950 WiFi authentication(?) issues (every 2 weeks)

[NutsWithWiFi]

Good Morning! 

I have an Orbi 953 (Costco version of Orbi 960 with a few differences), along with 2 satellite devices. I have around 90 devices connected across two SSIDs, let's call them "main" and "main_guest". 

My issue is this: 

a) I have around 40 IoT devices connected to my guest network (mostly wiz wifi lights)  that every once in a while (1-2 weeks) are not accessible via their app

b) I have, after a lot of fiddling figured out that when it happens, randomly a bunch of devices are not able to get a DHCP IP address on main_guest. I've validated this by running wireshark on my guest wifi and I see a bunch of DHCP requests that don't get resolved. 

c) What seems to "always" fix the issue is if I toggle the authentication mechanism of main_guest. If its set to WPA2-PSK[AES], I switch it to WPA2-PSK[AES]+WPA3-Personal[SAE] or vice versa and boom - all devices connect immediately and get an IP address (password is same)

I'm confounded why this issue keeps happening. Almost always, the issue shows up on my IoT devices first (as I can't control them) and sure enough, switching the auth method seems to work. No amount of router rebooting helps.

FWIW, I suspect this same issue seems to happen on my main network - a few months ago my IoT devices used to connect to "main" and they would often not be accessible. I never really triaged this much then - I just assumed it was a network load issue and moved several of them to guest. When it started happening again is when I started diving in.

More details on my setup:

HW RBRE950

Firmware: V6.3.7.10_3.3.3

1 Router + 2 satellites

IP Address:  10.0.0.1 

DHCP: On

- 20/40 Mhz coexistence is OFF (read in many places turning it on may cause IoT connectivity issues)

- Preamble for both 2.4/5 is automatic, power is 100%

- No access control

- 2.4 GHz channel. Auto (almost all of my IoT devices use this)

- 5GHz channel 48

- 6Ghz channel 69

- Main is set to WPA2-PSK AES + WPA3-Personal SAE

- Guest I keep toggling whenever I see the issue as mentioned above

Any hints would be super useful. Thank you.

My setup:

[CrimpOn]

---

@NutsWithWiFi wrote:

- 2.4 GHz channel. Auto (almost all of my IoT devices use this)

---

The 2.4G channel setting affects only the router.  WiFi devices scan the entire set of channels looking for an access point that has a strong signal and offers an SSID that they recognize.  "Auto" means that the router scans the 2.4G channels and picks one of them based on some algorithm that is not documented.  Some users prefer to specify the 2.4G channel based on their own analysis.  If the 2.4G channel is changed, all of the WiFi devices will soon find it.

Information about the 5G and 6G capability is not relevant:

They went for the oldest (and cheapest) 2.4G WiFi chips, not even supporting 802.11n (2009).

The RBK953 package supports a separate Internet of Things (IoT) SSID.  See page 64 of the User Manual:

https://www.downloads.netgear.com/files/GDC/RBKE963/RBRE960_RBSE960_UM_EN.pdf 

I have a suspicion*, and it is only a suspicion, that the guest network may have a time limit on how long devices are allowed to remain on the network, which might explain why devices broadcast DHCP requests that are not answered.

* Actually, it's a very dim memory from a post in the last month or so.  With my memory, it could have been a dream.

[FURRYe38]

You should be using the IoT specific network for any and all IoT devices. And not the guest network. Guest Network does have a limited least time and was never meant for long term use with IoT devices. 

---

@NutsWithWiFi wrote:

Good Morning! 

I have an Orbi 953 (Costco version of Orbi 960 with a few differences), along with 2 satellite devices. I have around 90 devices connected across two SSIDs, let's call them "main" and "main_guest". 

My issue is this: 

a) I have around 40 IoT devices connected to my guest network (mostly wiz wifi lights)  that every once in a while (1-2 weeks) are not accessible via their app

b) I have, after a lot of fiddling figured out that when it happens, randomly a bunch of devices are not able to get a DHCP IP address on main_guest. I've validated this by running wireshark on my guest wifi and I see a bunch of DHCP requests that don't get resolved. 

c) What seems to "always" fix the issue is if I toggle the authentication mechanism of main_guest. If its set to WPA2-PSK[AES], I switch it to WPA2-PSK[AES]+WPA3-Personal[SAE] or vice versa and boom - all devices connect immediately and get an IP address (password is same)

I'm confounded why this issue keeps happening. Almost always, the issue shows up on my IoT devices first (as I can't control them) and sure enough, switching the auth method seems to work. No amount of router rebooting helps.

FWIW, I suspect this same issue seems to happen on my main network - a few months ago my IoT devices used to connect to "main" and they would often not be accessible. I never really triaged this much then - I just assumed it was a network load issue and moved several of them to guest. When it started happening again is when I started diving in.

More details on my setup:

HW RBRE950

Firmware: V6.3.7.10_3.3.3

1 Router + 2 satellites

IP Address:  10.0.0.1 

DHCP: On

- 20/40 Mhz coexistence is OFF (read in many places turning it on may cause IoT connectivity issues)

- Preamble for both 2.4/5 is automatic, power is 100%

- No access control

- 2.4 GHz channel. Auto (almost all of my IoT devices use this)

- 5GHz channel 48

- 6Ghz channel 69

- Main is set to WPA2-PSK AES + WPA3-Personal SAE

- Guest I keep toggling whenever I see the issue as mentioned above

Any hints would be super useful. Thank you.

My setup:

---

[NutsWithWiFi]

Ok this is super useful. I did not realize Guest had a limited time leash, but so I understand:

If leash expires, clients should ask for a new DHCP allocation and get an IP. Why would a limited lease prohibit clients from getting a new IP on renew?

[FURRYe38]

The intent of GN is for limited use as most users/guests are visiting a guest location for a limited period of time. There is not need to have long least times. The lease time are set for one lease and after that would probably need to reboot or reconnect to the GN to get a new least and IP address. Again, something not designed or intended for for GN for long term IoT devices.  Use the IoT network, it's what this is for. 

[CrimpOn]

(It's probably too far "down the rabbit hole", but......)

If you are able to run a packet capturing application, such as Wireshark (https://www.wireshark.org free for Windows, Mac, Linux) it would be interesting to capture the DHCP conversation for devices connected to the guest WiFi.  On the primary network, Orbi routers typically offer a one day lease (actually, 86,400 seconds).  Devices start asking to renew the lease when only half of the time remains and finally have to abandon the IP entirely if the router does not offer them a lease after it is completely gone.

Just for myself, I am not ecstatic about the idea of "guests get only so long".  What happens when relatives come to visit for a week?  I guess dropping the WiFi connection and reconnecting will gain a new lease period.  Netgear does not document features such as this, so we can only speculate about motivation.

[NutsWithWiFi]

Thank you @CrimpOn @FURRYe38 for your recommendations. I've enabled the IoT network and moved most of my IoT devices there and will observe/post back in a few weeks (or days, if the situation chooses to reoccur).

Interestingly, there is an option in the Orbi Mobile app which doesn't show itself on the web config. It exposes a setting that lets me decide how long a guest should stay connected. Default is "always" but you can set it to a few hours. Mine was always. That being said, I don't know what other nuances Guest introduces that Orbi doesn't talk about, so I moved.

CrimpOn: I wish I had saved the DHCP packet trace - that is how I found out it was not responding to DHCP requests in my original post. If it happens again, I'll post.

I get the feeling I'll be back, so for now, "au revoir".

[FURRYe38]

👍

[NutsWithWiFi]

Okay, it happened again. The routers rebooted and I had DHCP allocation issues again.. Here is what happens: for some reason Orbi keeps sending back DHCP NAKs to many devices saying no more IPs to allocate. And that keeps looping (devices keep asking). This is odd, because my main network has at most 20-30 devices (across all my SSIDs its around 100, and my IP range is set to 10.0.0.2 - 1.0.0.254 or similar - surely > 150 hosts).  This only happens in the primary network (not IoT, not Guest). This starts happening right after I actually do DHCP IP address reservations in my router. So for now, I've disabled any DHCP ip address reservations and things are working again. This is so tiring -> I've gone ahead and also ordered an Asus XT12 set to see if this system will help alleviate.

[FURRYe38]

What happens if you set the default DHCP IP address pool range to the following after applying and a factory reset: 10.0.#.100 to 10.0.#.250.
https://kb.netgear.com/24089/How-do-I-specify-the-pool-of-IP-addresses-assigned-by-my-Nighthawk-rout...

What all devices do you have connected? 

Be sure any Apple Or Android devices have Mac Address randomizers disbled while at home:

https://community.netgear.com/t5/Orbi-App/NETGEAR-Mobile-Applications-and-Apple-Devices-FAQ/td-p/222...

[NutsWithWiFi]

The IP range is already set to 10.x (10.0.0.2 - 10.0.0.245).

This morning I did a factory reset, things worked well. The moment I turned on DHCP reservation for 4-5 IPs, I started seeing problems. So I factory reset again and turned off DHCP reservations. So far its working, but I don't trust for how long (plus this is getting way too tiring 🙂 )

In response to your question on kind of devices: Around 45 WiZ lights, 15 kasa switches, 4-5 sonos devices, 4-5 google hubs, a few wifi plugs, few TVs/streaming and multiple laptops, ipads, iphones

I've tried with both turning off Private IP and on. Note however, all these networks are my preferred networks, and therefore randomization will not apply (reference).

[bullm00n]

The problem I have with the dedicated IoT network, and why I'm not using it, is lack of support from other WIFI Routers and the gigantic hassle of going to 30 or more devices and changing the SSID they connect to...when using the 960. 

And maybe if the 960 was reliable I'd be OK with that.  But given that it is not and that I have to either use my old 850 or even the prospect of falling back to the xFi gateway as router / wifi, using a dedicated IoT network with a new SSID complicates things too much.  I don't know what other advantages having IoT on a separate SSID provides, but it's a no-go for me.

I've been getting by with main and guest with the 850 for a year and it has been fine - I only use guest for actual guests and haven't seen any issues with the 850.  As for the 960 - I'm neck deep in issues and since it restarts itself several times a day, "DHCP lease times" has not been a problem that has had time to manifest. 🙄

[FURRYe38]

Wondering if having all these devices online at once, if the DHCP server can't handle trying to give out all IP address assignments at one time. 

I would reduce the default DHCP IP address pool size to .100 to .200 and see. 

I would also power off half of these devices. Then power cycle the rest and bring them online one at a time. 

Please leave any MAC randomizers disabled on all phones and pads just while they are home. Randomizers can impact how DHCP services work and operate. 

---

@NutsWithWiFi wrote:

The IP range is already set to 10.x (10.0.0.2 - 10.0.0.245).

This morning I did a factory reset, things worked well. The moment I turned on DHCP reservation for 4-5 IPs, I started seeing problems. So I factory reset again and turned off DHCP reservations. So far its working, but I don't trust for how long (plus this is getting way too tiring 🙂 )

In response to your question on kind of devices: Around 45 WiZ lights, 15 kasa switches, 4-5 sonos devices, 4-5 google hubs, a few wifi plugs, few TVs/streaming and multiple laptops, ipads, iphones

I've tried with both turning off Private IP and on. Note however, all these networks are my preferred networks, and therefore randomization will not apply (reference).

---

[bullm00n]

---

@FURRYe38 wrote:

Wondering if having all these devices online at once, if the DHCP server can't handle trying to give out all IP address assignments at one time. 

I've seen, in my logs, the 960 router handing out over 50 DHCP addresses within 10 minutes when the router reboots itself.  My pool is set from 150-254.  Same with the 850 except that it doesn't reboot itself so it doesn't have to do it nearly as often.

[FURRYe38]

Try the beta FW?

https://www.surveymonkey.com/r/G32BGFF

[NutsWithWiFi]

Right, I do think there is something off with DHCP of Orbi. When I searched around, I did find other threads complaining of similar issues, but then this is the internet - we will find someone reporting a problem about every possible thing 😄

Anyway, I gave up. I'm not sold on making Orbi work - it was getting too painful and the experimentation was not worth my time investment. 

I've replaced my 963 with 4 XT12 Asus routers - its great for now, but then so was Orbi to start. We'll see! Thank you for all your support.

[FURRYe38]

Good Luck.