Check Point appliance 1530 wireless disassociation issues

[lmpv]

Hello,

I´m having problems with a 1535 appliance, in regards to Wifi.

Most of the clients are using MacOs, and the only thing that i can see on the logs is this:

 daemon.info hostapd: [Wireless] wlan0: STA 42:c3:8c:55:71:e8 IEEE 802.11: disassociated
daemon.info hostapd: [Wireless] wlan0: STA 5e:7b:3c:82:a9:b2 IEEE 802.11: disassociated
daemon.info hostapd: [Wireless] wlan0: STA 5e:7b:3c:82:a9:b2 IEEE 802.11: disassociated
daemon.info hostapd: [Wireless] wlan0: STA 02:e7:fc:c0:df:51 IEEE 802.11: disassociated
daemon.info hostapd: [Wireless] wlan0: STA 5e:7b:3c:82:a9:b2 IEEE 802.11: disassociated

local7.info dhcpd: DHCPREQUEST for 192.168.253.24 (192.168.253.1) from 68:7a:64:b3:20:95 (ALTW001) via wlan0
local7.info dhcpd: [Local Network: DHCP] DHCPACK on 192.168.253.24 to 68:7a:64:b3:20:95 (ALTW001) via wlan0
daemon.info hostapd: [Wireless] wlan0: STA 68:7a:64:b3:20:95 IEEE 802.11: disassociated

I would like some help on identifying the issue.

Regards

[PhoneBoy]

This is likely going to require TAC to assist.
What I saw in a similar TAC case that might be useful debug commands are as follows (all commands are in expert mode):

# iwpriv wlan1 dbgLVL 0x7FFFFFFF
# cat /proc/sys/kernel/random/entropy_avail > /storage/dbg_rand.txt

If trying to connect to the 2.4GHz wifi connection:
# hostapd_ctl restart wifi0 -d -l

Otherwise, if trying to connect to the 5GHz wifi connection:
# hostapd_ctl restart wifi1 -d -l 

The following files will need to be reviewed/supplied to TAC:

• /logs/hostapd.lo
• /storage/dbg_rand.txt
• The output file from CPinfo -d -D -z -o /var/log/<hostname>
  
  

[lmpv]

Hello Phoneboy,

I will gather all the information and post it here.

Thank you

[_Val_]

Please open a TAC ticket via https://help.checkpoint.com

[bs69]

Luis,

My name is Boaz and I'm in charge of SMB Wireless (WiFi). As Phoneboy requested, we will need to see hostapd log file to better understand what causes those MACs to request IP every 12 minutes and why they disassociate the way they do.
Can you also share your wireless configuration - what type of security settings (e.g. WPA3/WPA2) do you use? Are you seeing these on other, non Apple products?

Thank you,

Boaz.

[lmpv]

Hello Boaz,

The final customer send me this screeshoots today that i'm attaching.

Phonebiy did send this commands to be used for debugging but they are not working

If trying to connect to the 2.4GHz wifi connection:
# hostapd_ctl restart wifi0 -d -l

Otherwise, if trying to connect to the 5GHz wifi connection:
# hostapd_ctl restart wifi1 -d -l    

 i get this:

hostapd_ctl restart wifi0 -d -l
command:/pfrm2.0/bin/hostapd_ctl restart wifi0 -d -l
Unknown -l
Usage: /pfrm2.0/bin/hostapd_ctl CMD HOSTAPD_NAME [options]

This script controls hostapd
CMD: start, stop, restart
HOSTAPD_NAME: wired, wifi0, wifi1 if exists
Options:
-d Debug mode, log saved in /logs/hostapd.log
-h Print this help

Best regards

[G_W_Albrecht]

Which firmware is used ?

[lmpv]

Hello,

Adding in attachment a screenshot.

Regards 

[lmpv]

Hello Boaz,

Did you saw my message in regards to the outcome of the commands that Phoneboy send me?

Best regards 

[G_W_Albrecht]

Try /pfrm2.0/bin/hostapd_ctl restart wifi0 -d !

[G_W_Albrecht]

Why such an old firmware ?

Latest Firmware	R81.10.15 Build 996003913
Recommended Firmware	R81.10.10 Build 996002993

[Steffen_Appel]

That one is really old, AFAIR r81.10.10 is the recommended version.

[lmpv]

Hello Team,

Adding the files requested initialy.

• /logs/hostapd.lo
• /storage/dbg_rand.txt
• The output file from CPinfo -d -D -z -o /var/log/<hostname>

[lmpv]

Hello team,

sorry to bother you guys, but could see anything os the logs that i attached on my previous message?

File - ficheiros.zip

Best regards

[Chris_Atkinson]

Please upgrade the firmware and advise if the problem persists.

[G_W_Albrecht]

Please open a SR# with CP TAC so the issue can be resolved asap ! Better upgrade to R81.10.10 Build 996002993 first or TAC will make you do it anyway...

[lmpv]

Thank for the quick reply, i will perform the upgrade to see how it goes.

[G_W_Albrecht]

Any results yet?

[PhoneBoy]

I don't see anything in these files that might provide a clue.
In any case, you should open a TAC case.

[lmpv]

Hello,

Sorry for the delay on my update.

Just to give you an overview of what as been done.

We upgraded de appliance to the firmware  R81.10.10 Build 996002993 that was proposed, we did fix the problem with the VPN, but we still have the issue with the MacOs laptop that connects to the Wifi but as no internet access, attaching the logs in attachment. (ea:45:23:34:ad:a4 (Mac) via wlan0) - this is the Mac Address of the laptop.

Regards

[lmpv]

Hello Team,

The logs that i provide, can they give you clue of what might be the issue with Macos laptop being dissociated?

Best regards

[PhoneBoy]

Nothing in the logs really indicates why the laptop is disassociating.
Do you have a TAC case open on this issue?

[G_W_Albrecht]

After reading these logs, i would like to see the client logs from Mac VPN client during that issues.

An important question:  Are any RA VPN clients connecting and working as expected ?

[lmpv]

Hello,

There no VPN involved here, just an appliance 1530 with wirelless where the Mac connects and after a while is still connected but no internet access.

What i can do is to run wireshark on the laptop at the time that we have the issue and provide you the pcap.

Regards

[G_W_Albrecht]

Mixed it up wrong... What about DHCP logs ? Should be available somewhere...

[lmpv]

Hello Team,

Sorry for the delay on my answer, attaching de dhcp logs.

Mac Address of the laptop with the issue - 192.168.253.50 to ea:45:23:34:ad:a4 (Mac) via wlan0

Regards

[G_W_Albrecht]

What can you see in there ?

[lmpv]

This is what i can see on the logs:

lease 192.168.253.50 {

  starts 5 2025/04/04 08:43:48;

  ends 5 2025/04/04 16:43:48;

  tstp 5 2025/04/04 16:43:48;

  cltt 5 2025/04/04 09:28:15;

  binding state free;

  hardware ethernet ea:45:23:34:ad:a4;

  uid "\001\352E#4\255\244";

  set clop = "1,121,3,6,15,108,114,119,252,95,44,46";

}

lease 192.168.253.50 {

  starts 5 2025/04/04 08:43:48;

  ends 5 2025/04/04 16:43:48;

  tstp 5 2025/04/04 16:43:48;

  cltt 5 2025/04/04 09:28:15;

  binding state free;

  hardware ethernet ea:45:23:34:ad:a4;

  uid "\001\352E#4\255\244";

  set clop = "1,121,3,6,15,108,114,119,252,95,44,46";

}

[G_W_Albrecht]

Did you open a SR# with CP TAC already ?

[lmpv]

No i didnt,

I´m assuming your are going to tell me to open a ticket with TAC.

Nothing out of the ordinary was found on the logs?

Regards