Help with Unusual WiFi Connection Issue

[Cyntil8ing]

I recently bought a USB WiFi/BT dongle for a W11 rig as a quick and cheap backup connection. After messing around with it for a couple of days, I found a weird bug wherein it would prefer to connect to my primary router and not any of my APs that have better signal strength.

After some tinkering with different settings, I found out that it would only switch to the better signal AP if I switched my primary router to WPA2 authentication. It's decidedly prioritizing WPA3 to connect to over better signal strength with WPA2 APs.

My questions are, is there a way to prioritize better signal strength over authentication protocol? What determines connection prioritization? I'd really prefer to keep WPA3 when possible within the network.

Relevant Details:
8851BU based USB dongle
W11
RT-AX55 router
RT-AC68U APs

If I mis-posted this in the wrong topic, apologies. Advice on the right place would be appreciated.
Also, if there are other relevant details I missed, just ask.

 

[tgl]

Giving some preference to WPA3 doesn't sound like a bad idea to me. If the client were allowing that preference to make it choose a really bad signal, that wouldn't be great; but you have not offered any evidence about how bad the choice is. What actual signal strength are you seeing from the different APs where the laptop is located? (You need to measure that with a client-side tool like a wifi scanner app; don't trust what the APs think.) What connection speed do you get from each one?

Tools you have available to bend it to your will include adjusting the Tx power of the various APs, or setting up a WPA3-capable SSID for the laptop to connect to. I'm just wondering if you really have a problem to solve.

 

[Tech9]

I'd really prefer to keep WPA3 when possible within the network.

This doesn't make much sense because mixed WPA2/WPA3 network is not more secure than WPA2 only. Your APs don't support WPA3 anyway.

 

[Cyntil8ing]

Giving some preference to WPA3 doesn't sound like a bad idea to me. If the client were allowing that preference to make it choose a really bad signal, that wouldn't be great; but you have not offered any evidence about how bad the choice is. What actual signal strength are you seeing from the different APs where the laptop is located? (You need to measure that with a client-side tool like a wifi scanner app; don't trust what the APs think.) What connection speed do you get from each one?

Tools you have available to bend it to your will include adjusting the Tx power of the various APs, or setting up a WPA3-capable SSID for the laptop to connect to. I'm just wondering if you really have a problem to solve.

Yeah, WPA3 is preferable but, it's a significantly weaker signal that would have sporadic speeds (~10 mbps average with crazy spikes in both latency, ping, and speed) vs closer WPA2 AP (~290 mbps stable). On a side note, the dongle is used for a desktop during the rare cases that my fiber connect goes down and I switch to my mobile data plan.

Here are the readings of the primary router and the APs. The highlighted ones (blue) below are the ones that I use. The 1st one with the "AX PHY Type" is the primary router, the ones below it are the APs.
There's no Tx power adjustment on the stock AsusWRT as far as I know on the AX55. Not that it matters because the second the WPA3 is activated on the primary router, it's like the dongle is tethered to the primary router so long as the signal is detectable no matter how weak it is or how strong the APs signals are. The only time everything works-as-intended is when I drop the WPA3 to WPA2.

As for having a problem, I guess I'm just trying to solve for WPA3 as an option because it's more secure and hopefully learn how W11 determines WiFi prioritization. It could also be by design by the Realtek drivers.

 

[Cyntil8ing]

This doesn't make much sense because mixed WPA2/WPA3 network is not more secure than WPA2 only. Your APs don't support WPA3 anyway.

I did not know this. I was thinking that my use case WPA3 is a "best effort" solution. Meaning, WPA3 when possible but WPA2 for compatibility's sake.
If I understand you properly, do you mean that WPA3 is a moot point because I have WPA2 on and that even when my newer devices capable of WPA3, it's not more secure in my use case? I was thinking they both could coexist and whatever device connected to WPA3 was more secure.
I am, admittedly, ignorant of this.

 

[Tech9]

WPA3 is more secure, but when you have WPA3 only. When you have WPA2 option enabled what’s the problem exploiting the potential WPA2 vulnerabilities?

 

[tgl]

I think your real problem is that all of those wifi signals are awful, with the exception of the last one at -52dBm. Anything worse than about -65dBm is not going to provide a high-quality wifi experience, and I bet your wifi dongle is ranking them all as about equivalent signal-wise. Don't know why it's not choosing the -52 signal, but it looks like you need another AP located closer to where you use this laptop.

As @Tech9 says, mixed WPA2/WPA3 doesn't buy much security-wise. Doesn't help to have a super-duper lock on the front door if the back door is unlocked.

 

[Cyntil8ing]

WPA3 is more secure, but when you have WPA3 only. When you have WPA2 option enabled what’s the problem exploiting the potential WPA2 vulnerabilities?

Ok, I think I understand what you're saying. The added vulnerability simply exists simply by having WPA2 on as an option.
Well, that extra bit of information narrows my solutions then. Keep WPA2/WPA3 configuration and just switch to WPA2 when the dongle is needed during outages or keep it on WPA2 full time.
Thanks for the information.

 

[Tech9]

Just use WPA2-Personal. It works well and makes the network more compatible without PMF requirements. The vulnerabilities are theoretical and only in close proximity to your Wi-Fi. The cat lady next door is highly unlikely to hack your network and 30m away your 5GHz signal is too weak anyway. If you have no-name IoT devices they are much greater threat and none of them supports anything better than Wi-Fi 4.

 

[Cyntil8ing]

I think your real problem is that all of those wifi signals are awful, with the exception of the last one at -52dBm. Anything worse than about -65dBm is not going to provide a high-quality wifi experience, and I bet your wifi dongle is ranking them all as about equivalent signal-wise. Don't know why it's not choosing the -52 signal, but it looks like you need another AP located closer to where you use this laptop.

As @Tech9 says, mixed WPA2/WPA3 doesn't buy much security-wise. Doesn't help to have a super-duper lock on the front door if the back door is unlocked.

Yep. The dongle was locked to that weak AX -78dBm signal when WPA3 on the primary router was activated regardless of signal strength.
Ideally, it should switch to the -52dBm AP but it doesn't until I disable WPA3 on the primary router. When the primary router is switched to strictly WPA2, the dongle then switches to the best signal as expected. I'm guessing it's a bug of some sort involving the dongle.

At any rate, @Tech9 's bit of information kinda informs me of my options at this point seeing as a pure WPA3 solution isn't a viable option for me at this point. I'm also hardwired a vast majority of the time. The dongle is a just-in-case bit of gear for those rare occasions that my fiber goes down and I need to switch to mobile data.

Thank you as well for helping me out with this issue.

 

[Tech9]

pure WPA3 solution isn't a viable option for me at this point

Most likely you'll never reach this point. You have to get rid of all clients below AX and make sure the new ones support WPA3 only.

 

[tgl]

Most likely you'll never reach this point. You have to get rid of all clients below AX and make sure the new ones support WPA3 only.

Not sure about the "below AX" part. AFAICT everything Apple has made since about 2018 can do WPA3. I have a primary SSID which is WPA3-only, and I'm successfully running all my Apple gear on that, including old iPads (ac generation) and watches (WiFi 4 only). I have to run a separate WPA2 SSID for assorted IoT-grade gear, but I'd just as soon keep that stuff on a less-trusted network anyway. (This is with UniFi APs; not sure if it's possible to replicate this configuration on Asus APs.)

 

[Tech9]

Unfortunately, many devices with no Wi-Fi 6 support have no WPA3 support.