UniFi - Network Controller: Association Failures


Overview


This article contains information about the association failures widget found in the UniFi Controller (version 5.9+), and will explain how association failures are detected and tracked by UniFi.

NOTES & REQUIREMENTS:
Association failure tracking is in continuous improvement. For best results, upgrade to the newest firmware version. Association tracking was introduced in UniFi Access Point (UAP) firmware 3.9.28 (MAC ACL rejections was introduced in 3.9.26). This article provides information on which version certain tracking features were released. Not implemented yet on UAP models: Nano HD and HD-IW.

Table of Contents


  1. Introduction
  2. Failure Types
  3. Related Articles

Introduction


Back to Top

The association failures widget gives visibility into issues clients are facing when trying to connect to the wireless network and access essential services like DHCP, ARP, and DNS. When clients connect to the network via WiFi, they can experience a number of issues:

  • The client device is on the MAC ACL blacklist (or not on the whitelist), so it either doesn’t see the wireless network at all, or it will experience a pre-WPA authentication failure when trying to connect. Pre-WPA authentication is the authentication frame sequence that occurs before Association and WPA/RADIUS authentication.
  • Pre-WPA authentication failure or association failures, for any number of reasons. For example, the AP rejects association request, frames are lost due to interference, among others.
  • WPA or RADIUS authentication errors, for any number of reasons. For example, wrong password, invalid username, dropped frames, etc.
  • DHCP errors: if the client uses DHCP / or is not configured to use static IP. For instance, if the USG has exhausted DHCP leases, DHCP frames are dropped, etc.

Failure Types


Back to Top

Association Timeout:

  • Counts the number of times WiFi association did not complete for any number of reasons. These reasons could include the AP rejecting the association, frames sent between the AP and client during the association process being missed, interference, etc. 
  • Available on UAP firmware 3.9.28 and newer. 

WPA Auth Timeout/Failure:

  • Counts the number of times WPA authentication (4-way handshake) did not complete.
  • Some common causes are:
    • Incorrect WPA password
    • Incorrect WPA Enterprise/RADIUS username or password
  • Available on UAP firmware 3.9.28 and newer.

Blocked By Access Control:

  • Counts the number of times probe requests and pre-WPA auth requests were rejected because of MAC ACL settings under SSID settings. 
  • Some common causes are:
    • A client blocked in the dashboard. In the UniFi Controller, go to Insights > Known Clients > Select "Blocked" and "All" for the time frame. 
    • A client is not whitelisted or on the blacklist under the SSID settings. Settings > Wireless Networks > MAC Filter.
  • Available on UAP firmware 3.9.26 and newer.
    NOTE: Association timeouts (first category) and blocked by access control are mutually exclusive: i.e. association timeouts do not include blocked by access control.

DHCP Timeout/Failure:

  • Counts number of times a client tried to acquire DHCP lease, but the process did not complete (client did not receive DHCP offer or ACK).
  • Common causes:
    • DHCP lease pool exhausted.
    • DHCP server unreachable or misconfigured.
  • Available on UAP Firmware 3.9.28 and newer. 

Related Articles


Back to Top

UniFi - Debugging Intermittent Connectivity Issues on your UAP


We're sorry to hear that!