Different problems with AP6

Hi,

we're struggling for a while with our new XGS + AP6 environment.
Problems are different, most not fully reproducable, but customers are getting crazy trying to use wifi.

LAN is working properly, we also have XGS with similar config (but with APx)  in other offices and no problems with LAN+Wifi there.

The network and the local distribution of AP have already been there, we only switched vom UTM SG to XGS and from APx to AP6.
Since then wifi is horrible....

Problems with AP6 are:
- roaming (or maybe also logging in without roaming befor)...
...is not working, it takes very long to reconnect
...often connecting is stuck while "obtaining ip"
...sometimes connects but with poor connection (1 wifi bar) and after connecting it reconnects with 3 wifi bars
...sometimes you get connected after the 2 oder 3rd attempt, but you have no internet access
...sometimes you get kicked while roaming...
..... and you have to connect manually again
..... or you have no chance to reconnect till ...
......... you switch your wifi off and on again
......... or you delete the wifi and connect with entering the Key again

- Captive portal, Voucherpage, ist not working
....sometimes only getting blank page
....sometimes you can open the page and there's a message that your session timed out and you have to reload
....entering a Voucher code or, in out other wifi, LDAP-Credentials, is not working, always "invalid"


We have tested many things - often with sophos support included (since august):
- fastroaming on (on each AP6, each network)
- 5 Ghz off (in Central)
- extend DHCP lease time for AP and for clients (on XGS)
- toggle on the OVER THE DS (on each AP6, each network)
- RSSI threshold changes from -80dBm to -70dBm(on each AP6, each network)
- choose WPA2-EAP as the WPA type (on each AP6, each network - of course this destroyed our WPA2-Auth)
- checked Location of each AP
- checked powesupply of each AP
- change channels
- checked communication from AP6 to Central and VLANs to XGS with wireshark, seems ok - respondtimes are good

Maybe similar to community.sophos.com/.../527694 and community.sophos.com/.../central-wireless-radius-roaming-clients-between-apx320-and-apx530-lose-connection-when-on-apx530 , maybe community.sophos.com/.../wlan-wifi---clients-can-not-communicate-after-roaming-twice---openwrt-bug

Any ideas?

Greetings from Germany