RT-AC86U - WPA2 Enterprise / RADIUS leaving clients associated but not authed

[homenetworkyeet]

Essentially, it could be for a couple hours, or for a quarter of an hour, but clients still believe they are connected to WIFI but the router has de-authed them and does not automatically reauthenticate with RADIUS / rekey.
I've tested this with a different router using the same RADIUS server and it's fine. So what could be happening in this case where it remains associated but not authenticated?
I have been troubleshooting this for a while and some said to disable beamforming and some other things but that didn't help.
There's also the 802.1x mode (how is that different?) if you downgrade the WIFI protocol but due to lesser transfer speed this isn't ideal.
Anyone have any ideas for where I can investigate further? It's not great because my phone in the morning still appears connected but has been deauthed for some hours. Any other screenshots I can provide let me know.

 

[Maverickcdn]

What does the authentication flag show under Log-->Wireless Log when the issue happens? Anything in the radius and/or router logs?

I've been running Radius (w/o certificate, just username/pass) on a QNAP NAS for many years and never had any issues.

 

[heywire]

Welcome, fellow wanderer; read and you shall learn:

386.4: AC86U losing 2.4 GHz devices

The last couple of days my RT-AC86U running Asuswrt-Merlin 386.4 is losing some/all devices on the 2.4 GHz band (on both the regular and all three 2.4 GHz guest networks); devices on the 5 GHz band are fine (wired as well). Restarting the wireless service (service restart_wireless) does not...

www.snbforums.com

We are waiting for Asus to get their s*** together once and for all with regards to the AC86U for the next firmware release. Especially the GPL release that goes into the next version of Merlins custom firmware (386.5), which has been broken for ages on the Ac86U.

Personally, that's the last shot I'll give it before I go ballistic. Such absolute abundance of nonsense produced by this company on such a premium (conumer grade premium) product at this point in its life-cycle, I could probably finance the production of an open source competitor for the billable hours I spent on it lately.

 

[homenetworkyeet]

What does the authentication flag show under Log-->Wireless Log when the issue happens? Anything in the radius and/or router logs?

I've been running Radius (w/o certificate, just username/pass) on a QNAP NAS for many years and never had any issues.

It says the message about station disassociated. Same flags are set on the device except the 'Auth' flag. Radius does indeed reauthenticate as I see in my syslog but the client never hears about it.

Welcome, fellow wanderer; read and you shall learn:

386.4: AC86U losing 2.4 GHz devices

The last couple of days my RT-AC86U running Asuswrt-Merlin 386.4 is losing some/all devices on the 2.4 GHz band (on both the regular and all three 2.4 GHz guest networks); devices on the 5 GHz band are fine (wired as well). Restarting the wireless service (service restart_wireless) does not...

www.snbforums.com

We are waiting for Asus to get their s*** together once and for all with regards to the AC86U for the next firmware release. Especially the GPL release that goes into the next version of Merlins custom firmware (386.5), which has been broken for ages on the Ac86U.

Personally, that's the last shot I'll give it before I go ballistic. Such absolute abundance of nonsense produced by this company on such a premium (conumer grade premium) product at this point in its life-cycle, I could probably finance the production of an open source competitor for the billable hours I spent on it lately.

Strangely, this doesn't happen for me on regular old WPA2-PSK, devices stay connected or at least don't have this problem of appearing connected with no actual connectivity. I haven't been running anything that requires consistent connections, though, so it /could/ have a random dropout without me being aware.

I resorted to using a second router with openWRT where you can swap out different 'wpad' (unrelated to web proxy auto discovery) packages for wireless and it works like magic. Whilst it makes me tempted to install pfsense on the ASUS instead, it would be nice to have this working. Do you think it's specific to this device, then?