WLAN / WIFI - Clients can not communicate after roaming twice - OPENWRT Bug

• Customer uses a sophos Wifi infrastruckter with a SG210 Cluster since 7 years- Models: AP50/AP55/AP/100/AP100X
• SSID with WPA2 PSK
• testing in 2.4, 5G  and both together
• One Client starts at AP1, the other at AP2
• tested Firmware Version: 9.702-1 / 9.703-3 / 9.704-2
• the client devices, APs, network devices are pingable all the time from LAN network. There is no packetloss due roaming
• no features involved like client isolation and so on
• no matter if the ssid is bridge to AP-LAN or bridge to vlan
• due the movements each client pings the other one
• Sometimes the device will meet on the same AP

Initial:

(AP1)------------------------------------(AP2)

(Device1)---------------------------(Device2)

1st movement (communcation between Device 1 and 2 ok)

=============>(Device1)   moving

=============(Device 2)    stays and meet Device 1 on same AP

(Device2)<=============    moving

(Device1)<=============    moving

(Device 2)    meeting (Device 1) on same AP

 =============>(Device 2)   moving

... connection is broken 

Issue:

• After the parties have crossed each other, reside on the same AP one time and came back to their first location, they are unable to communicate
• This might happend after the second crossing sometimes
• this only affects wifi clients to wifi clients on different accesspoints in the same SSID
• What we figured out is, that one AP is filtering the ARP Replys between interface wlan11 and br-lan
• this could be seen by a tcpdump on the AP as shown on the pictures

• Wireshark Window on the Client (ARP)
• left shell tcpdump wlan11 (ARP)
• right shell tcpdump br-lan (ARP)

So from our point of view, the issue is located in the OPENWRT Firmware, because the packets get lost between the "wlan" and "br-lan" interface.

As we checked on the web, there are complains @ openwrt community about that issue.

Notes:

• This is reproduceable - we did it three times with different hardware.
• We know that this usecase is a little bit special.
• How we get that? At the customers site some robots are traveling through the factory and they have to communicate to each other by WiFi. So we have noticed a connection loss after some movements.

If you are interested, explore it yourself and report it to sophos, maybe they will solve it quickly

best regards Daniel