Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Seamless roaming

    Scheduled Pinned Locked Moved Off-Topic & Non-Support Discussion
    265 Posts 9 Posters 98.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • JeGrJ
      JeGr LAYER 8 Moderator @Qinn
      last edited by

      @Qinn Just to chime in quickly from the left field: I'd also advise to reconsider the need for 4 (or more) SSIDs as every SSID you use slows down the bandwith of your WiFi so the less you use, the more you get on your devices. If you do it "right", all you need are one or two SSIDs anyway. One running Radius based VLANs (perhaps together with freeradius on your pfsense) and one for those old/dumb devices, that don't work with AES-Enterprise WiFi (User/Pass instead of shared key). :)

      Don't forget to upvote 👍 those who kindly offered their time and brainpower to help you!

      If you're interested, I'm available to discuss details of German-speaking paid support (for companies) if needed.

      QinnQ 1 Reply Last reply Reply Quote 2
      • QinnQ
        Qinn @JeGr
        last edited by

        @JeGr Thanks for the hint, I will reconsider.

        Hardeware: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz 102 GB mSATA SSD (ZFS)
        Firmware: Latest-stable-pfSense CE (amd64)
        Packages: pfBlockerNG devel-beta (beta tester) - Avahi - Notes - Ntopng - PIMD/udpbroadcastrelay - Service Watchdog - System Patches

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator
          last edited by johnpoz

          To chime in on that as well - if you really really want to get fancy.. You might even be able to get by with just 1 ssid.. where you assign vlans based on mac of the devices.

          Maybe just 2 if you want a enterprise auth ssid, and for those iot devices and such just use psk, I did a test a while back they first came out with the dynamic vlan support, and I did get it to work based on mac for psk devices..

          I was thinking at one time to go down this path.. But haven't gotten back to it ;) Lots of devices - all working, segmented out how I want.. Haven't found the motivation to change it all up just to drop a couple of ssids ;)

          While sure the fewer the ssids the better if your looking to max tweak your setup.. A couple of extra ssids not going to be a big difference in overall performance ;)

          Here this might help
          https://help.ui.com/hc/en-us/articles/360015268353-UniFi-USG-Configuring-RADIUS-Server

          You can use freerad on pfsense for this vs using the radius server of usg..

          I currently use 4 ssids = 4 different vlans
          1 wpa2-enterprise with eap-tls auth, this is for my trusted devices. My phone, Wife's phone, my laptop, my tablet, etc.
          2 wpa2-psk for iot devices, thermostat, alexa devices, smart bulbs, the like
          3 wpa2-psk for roku/tv stuff. My harmony remote, tv, roku sticks
          4 wpa2-psk for guest devices.. Even setup QR code on a business card I can give guest so they can just scan the qr code with their phone and get on.. Zero reason for them to type out the very long and complex psk ;)

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          QinnQ 1 Reply Last reply Reply Quote 0
          • QinnQ
            Qinn @johnpoz
            last edited by

            Thanks guys and thanks john, for now I will stay on 4 ssids = 4 different vlans ;)

            @johnpoz First things first reporting back, I tried the link to remove the element ssid using the classic settings, alas no avial. Then the new settings and deleted it, worked like a charm.

            Second, I have encountered a strange problem and after more than 2 hours I just can't quite put my finger on it. I have 2 nodes each none connected to a different wireless bridge, both of the same vendor, both with the same firmware version. They are in different vlans, until I switched over from Engenius to UniFI the both worked like a charm. With UniFi one is connected to the AP and the other one not. It doesn't seem to be related to the wireless bridge, because when I switched the wireless bridge that could not access the vlan to the other vlan it connected, I have no idea why it cannot access the one vlan an no the other?

            btw is see this

            Channel     Auto(8(6,+1) HT40
            

            What channels are these?

            Hardeware: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz 102 GB mSATA SSD (ZFS)
            Firmware: Latest-stable-pfSense CE (amd64)
            Packages: pfBlockerNG devel-beta (beta tester) - Avahi - Notes - Ntopng - PIMD/udpbroadcastrelay - Service Watchdog - System Patches

            1 Reply Last reply Reply Quote 0
            • johnpozJ
              johnpoz LAYER 8 Global Moderator
              last edited by johnpoz

              @Qinn said in Seamless roaming:

              Auto(8(6,+1) HT40

              Yeah that is horrible setup.. HT40 is not a supported option on 2.4... I would HIGHLY suggest you set 20 VHT on your 2.4 even if some clients and vendors say they support this.. It is not a standard that is supported and it will and does cause all kinds of issues.. And also use of anything other than 1,6 or 11 on 2.4 is just pointless.. Even if some auto config says hey lets use channel 8.. It's Borked!! with 2.4 the only channels that do not overlap are 1,6 and 11..

              channel.jpg

              I have no idea why it cannot access the one vlan an no the other?

              Your going to need to give a bit more detail on how exactly you have this setup.. What are you rules on the vlans you created? How you have it actually wired up, etc. etc..

              These wireless bridges? How do you have them connected? What make/model of these devices? You have them connecting to your AP ssids? and then what wired devices hanging off them?

              An intelligent man is sometimes forced to be drunk to spend time with his fools
              If you get confused: Listen to the Music Play
              Please don't Chat/PM me for help, unless mod related
              SG-4860 24.11 | Lab VMs 2.8, 24.11

              QinnQ 1 Reply Last reply Reply Quote 0
              • QinnQ
                Qinn @johnpoz
                last edited by Qinn

                @johnpoz Thanks I will change this setting to HT20

                After 4 hours I found it 🙏

                High Performance Devices (Beta): Connects high performance clients to 5 GHz only
                

                ... the above feature was enabled in the vlan that the wireless bridge could not access, once removed it can access

                Hardeware: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz 102 GB mSATA SSD (ZFS)
                Firmware: Latest-stable-pfSense CE (amd64)
                Packages: pfBlockerNG devel-beta (beta tester) - Avahi - Notes - Ntopng - PIMD/udpbroadcastrelay - Service Watchdog - System Patches

                1 Reply Last reply Reply Quote 0
                • johnpozJ
                  johnpoz LAYER 8 Global Moderator
                  last edited by

                  Do these devices support 5ghz? That is something like band steering.. Trying to push clients to 5ghz.. but sure there could be problems with that depending on the client.

                  An intelligent man is sometimes forced to be drunk to spend time with his fools
                  If you get confused: Listen to the Music Play
                  Please don't Chat/PM me for help, unless mod related
                  SG-4860 24.11 | Lab VMs 2.8, 24.11

                  QinnQ 1 Reply Last reply Reply Quote 0
                  • QinnQ
                    Qinn @johnpoz
                    last edited by Qinn

                    @johnpoz What do you say about the transmit power, auto, high or manual? btw no the wireless bridge only supports 2.4 and never enabled this on on that vlan, strange...

                    Hardeware: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz 102 GB mSATA SSD (ZFS)
                    Firmware: Latest-stable-pfSense CE (amd64)
                    Packages: pfBlockerNG devel-beta (beta tester) - Avahi - Notes - Ntopng - PIMD/udpbroadcastrelay - Service Watchdog - System Patches

                    1 Reply Last reply Reply Quote 0
                    • johnpozJ
                      johnpoz LAYER 8 Global Moderator
                      last edited by

                      I have mind set manually.. But I have a small house and not a lot of distance between AP so 2.4 is always set to low..

                      You can play with that.. Transmit power is a very misunderstood setting - many people think hey should always be HIGH.. That is not true at all.. Doesn't make any sense for a client to see an AP 300 ft away, if its little transmitter can not get back, etc.. So power should be setup for your layout and clients and possible interference/walls, etc.

                      You can try just auto and give it some testing.. And then only tweak if you run into issues with connectivity or roaming problems.

                      An intelligent man is sometimes forced to be drunk to spend time with his fools
                      If you get confused: Listen to the Music Play
                      Please don't Chat/PM me for help, unless mod related
                      SG-4860 24.11 | Lab VMs 2.8, 24.11

                      QinnQ 1 Reply Last reply Reply Quote 0
                      • QinnQ
                        Qinn @johnpoz
                        last edited by

                        @johnpoz Could you explain me why not use HT40 on 2.4, it means higher speeds. For 5GHz you use 40HT? btw why can't I set the both channels manually, so like 6+11, here I have no interference at all.

                        Hardeware: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz 102 GB mSATA SSD (ZFS)
                        Firmware: Latest-stable-pfSense CE (amd64)
                        Packages: pfBlockerNG devel-beta (beta tester) - Avahi - Notes - Ntopng - PIMD/udpbroadcastrelay - Service Watchdog - System Patches

                        1 Reply Last reply Reply Quote 0
                        • NogBadTheBadN
                          NogBadTheBad
                          last edited by NogBadTheBad

                          There are only 3 non overlapping channels @ 2.4 Ghz 1, 6 & 11 or 1, 7 & 13 in Europe.

                          If you set HT40 @ 2.4 Ghz you'd have even less non overlapping channels, both these are HT20 @2.4 Ghz.

                          Screenshot 2020-06-04 at 17.36.01.png

                          Andy

                          1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

                          1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator
                            last edited by

                            @NogBadTheBad said in Seamless roaming:

                            If you set HT40 @ 2.4 Ghz

                            True - and its not a valid standard either.. Even you had no other networks in the area at all, and only 2 AP or even just 1.. its not a standard - and will be hit or miss based upon your client.. So ok if you have 1 client and it supports it, and you have zero other wifi in the area on 2.4 you might be able to get away with it.. But if what your after is speed 2.4 is not the way to go anyway.. .You should be on AC on 5ghz ;) Going to just blow away even a 3x3 2.4 client on 40mhz..

                            2.4 best you could get with 3 stream client.. Those are like unicorns in the first place, rare as F.. Is a 450 PHY with short GI and 40 VHT.. With 2 stream client your talking only 300 PHY.

                            With AC 2x2 client using just 40 vht can get 400, which is very common.. Or even more common is use 80 VHT (standard) on 2 streams a 867 PHY which over double would could ever get on 2.4 even using the unsupported and non standard 40 vht on it..

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            QinnQ 1 Reply Last reply Reply Quote 0
                            • QinnQ
                              Qinn @johnpoz
                              last edited by

                              @johnpoz Second one up and running, adoption went smooth 1-2.png

                              Hardeware: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz 102 GB mSATA SSD (ZFS)
                              Firmware: Latest-stable-pfSense CE (amd64)
                              Packages: pfBlockerNG devel-beta (beta tester) - Avahi - Notes - Ntopng - PIMD/udpbroadcastrelay - Service Watchdog - System Patches

                              1 Reply Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator
                                last edited by

                                36 and 44 are bad choices if you want to run 80 vht.. Since they overlap..

                                Thought we went over this already 36 and 149 are the 2 5ghz channels that do not overlap for 80 vht.

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.8, 24.11

                                QinnQ 1 Reply Last reply Reply Quote 0
                                • QinnQ
                                  Qinn @johnpoz
                                  last edited by Qinn

                                  @johnpoz
                                  Firefox_Screenshot_2020-06-05T12-56-31.049Z.png

                                  I can only choose from channels.jpg when on VHT40 when I switch to VHT80 136 is removed from that list?

                                  Hardeware: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz 102 GB mSATA SSD (ZFS)
                                  Firmware: Latest-stable-pfSense CE (amd64)
                                  Packages: pfBlockerNG devel-beta (beta tester) - Avahi - Notes - Ntopng - PIMD/udpbroadcastrelay - Service Watchdog - System Patches

                                  1 Reply Last reply Reply Quote 0
                                  • johnpozJ
                                    johnpoz LAYER 8 Global Moderator
                                    last edited by

                                    Oh your in Europe - yeah I don't believe unii-3 is used in Europe.. Hmm your kind of screwed then for non overlapping Unless your clients are ok with dfs channels.

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                                    1 Reply Last reply Reply Quote 0
                                    • QinnQ
                                      Qinn
                                      last edited by Qinn

                                      @johnpoz Wi-Fi AI en Airtime Fairness would you recommend them and are there any other settings you would advise to be set?

                                      Hardeware: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz 102 GB mSATA SSD (ZFS)
                                      Firmware: Latest-stable-pfSense CE (amd64)
                                      Packages: pfBlockerNG devel-beta (beta tester) - Avahi - Notes - Ntopng - PIMD/udpbroadcastrelay - Service Watchdog - System Patches

                                      1 Reply Last reply Reply Quote 0
                                      • johnpozJ
                                        johnpoz LAYER 8 Global Moderator
                                        last edited by johnpoz

                                        Airtime fairness would depend on your environment and how you use wireless.. If you want to make sure no wifi client hogs up all the bandwidth then yeah you can turn that on... But will most likely notice that your top speed will drop for any single client.. For example - values will depend on your internet and how your testing.. But with off you might see say 400mbps from a client, while on maybe only 300.. And if lots of other clients on maybe only 200..

                                        Something you will have to experiment with for your own setup and clients and use case and what exactly you want to accomplish.. I have it off.. But maybe you want it on?

                                        The name kind of describes what it does - it tries to be fair to all clients on how much of the airtime (wifi) they can use.

                                        If you were doing something stupid like trying to do torrents over wifi, more than likely you would like it on ;) If you have a client that likes to download large files over wifi while your trying to stream netflix, again you might want it on.. etc. etc.

                                        if you like to see max possible speed when doing speedtest over your wifi - you prob want it off ;)

                                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                                        If you get confused: Listen to the Music Play
                                        Please don't Chat/PM me for help, unless mod related
                                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                                        QinnQ 1 Reply Last reply Reply Quote 0
                                        • QinnQ
                                          Qinn @johnpoz
                                          last edited by

                                          @johnpoz Thanks John, are there any settings you would advise?

                                          Hardeware: Intel(R) Celeron(R) J4125 CPU @ 2.00GHz 102 GB mSATA SSD (ZFS)
                                          Firmware: Latest-stable-pfSense CE (amd64)
                                          Packages: pfBlockerNG devel-beta (beta tester) - Avahi - Notes - Ntopng - PIMD/udpbroadcastrelay - Service Watchdog - System Patches

                                          1 Reply Last reply Reply Quote 0
                                          • johnpozJ
                                            johnpoz LAYER 8 Global Moderator
                                            last edited by

                                            Pretty much default should work for you out of the box... But everyone's wants out of their wifi is different.. Their client make is going to be different..

                                            What is so nice about unifi is feature set - if you need X you can use it, Maybe I don't want X but Y as setting.. Unifi exposes and allows for pretty much all the major settings that you would find in a very expensive enterprise wifi setup.. While being a reasonable price for the home enthusiast to be able to leverage..

                                            Unlike your typical home soho router that allows for user to like set a ssid, and then turn it off and back on again if something is not working.. And that is pretty much the extent of what you can do with it ;) It either works for you or it doesn't - there is really nothing else to do.. .The maker of said device made all the choices of what features to support or not support for you.. And then they will abandon that model in a year, and say oh you want to do X - yeah buy this years model ;)

                                            Have you updated to the beta firmware and controller?

                                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                                            If you get confused: Listen to the Music Play
                                            Please don't Chat/PM me for help, unless mod related
                                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                                            QinnQ 1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.