====== TELUS T3200M Wi-Fi Auth Lockout ======

**Status:** Resolved\\
**Observed:** 2026-10-12\\
**Affects:** TELUS T3200M gateway, any Wi-Fi client

===== Symptom =====

One device drops off the home SSID mid-session and then reports the correct password as "incorrect" on every attempt. All other devices keep working fine.

===== Cause =====

The gateway's SmartSteering (band steering) disassociated the client from one band via a BSS Transition Management frame ("Disassociation Imminent"), and the wireless daemon kept corrupted auth state for that client. Every subsequent WPA 4-way handshake is dropped with ''Reason: 2=PREV_AUTH_NOT_VALID'' or ''Reason: 15=4WAY_HANDSHAKE_TIMEOUT'', which NetworkManager reports as ''WRONG_KEY'': the "incorrect password" prompt. The stored password was correct the whole time.

Already-connected devices are unaffected because they never re-run the handshake. "Other devices work" does not rule this out.

===== Diagnosis =====

From the affected device (on a hotspot if needed):

<code bash>
nmcli device wifi list          # confirm the SSID is broadcasting
journalctl -b --no-pager | grep -E "wlo1.*(Reason|deauth|WRONG)"
</code>

The signature in logs: ''WNM: Disassociation Imminent'' (the AP initiated the disconnect), then ''PREV_AUTH_NOT_VALID'' or ''4WAY_HANDSHAKE_TIMEOUT'' followed by ''WRONG_KEY''. The device associates fine but dies during the handshake and never reaches DHCP, so IP-layer fixes are irrelevant. Connecting happily to a phone hotspot while failing the home SSID is itself strong evidence the fault is router-side.

===== Fix =====

  1. **Do not retype the password first.** Check the stored one: ''nmcli --show-secrets connection show <ssid> | grep psk''. Re-entering a mistyped password while the router's auth state is still broken keeps failing after the router is fixed and looks identical.
  2. **Power-cycle the gateway**: unplug ~30 seconds, plug back, wait for the SSID to reappear.
  3. Reconnect: ''nmcli --ask connection up <ssid>''.
  4. If it still fails: check the gateway admin UI (''http://192.168.1.254'') for a paused or blocked device, and confirm wireless security is still WPA2 rather than WPA3/transition or "PMF required".

===== Discriminators While Diagnosing =====

<code bash>
# force the 2.4 GHz radio (rule out a band with broken auth state)
nmcli con mod <ssid> 802-11-wireless.bssid <bssid>

# connect as a "new device" (rule out per-MAC blocking)
nmcli con mod <ssid> 802-11-wireless.cloned-mac-address random

# revert afterwards
nmcli con mod <ssid> 802-11-wireless.bssid "" \
    802-11-wireless.cloned-mac-address "" 802-11-wireless-security.pmf 0
</code>

===== Prevention =====

Disable SmartSteering on the T3200M to remove the trigger: admin UI > Wireless Setup > SmartSteering > Disable > Apply. Costs: the gateway may split the SSID into ''-2.4G'' and ''-5G'' variants (rename both back to the same name and passphrase so devices pick their own band), and paired Wi-Fi extenders can be factory-reset by the change.

===== See Also =====

  * [[troubleshooting:start|Troubleshooting Log]]
  * [[folkzone:networking:wifi_power_save|WiFi Power Save Issues]]
  * [[folkzone:troubleshooting:network_connectivity_issues|Network Connectivity Issues]]
  * [[start|Return to wiki home]]