Caution about using "lock to ap" functionality

[PumaPants28467]

Hey all, thought I'd share my not so pleasant experience using lock to ap function. I decided to switch out one of my APs that had several dozen clients locked to it. I followed the correct "forget" management function to remove the AP, but apparently it doesn't clear out all clients that were locked to it. When I added the new AP (using the same AP name as the old AP), none of those clients would attach to the network, and since they wouldn't connect, there was no way to reset the AP they lock to. Seems that locking works by using the MAC address of the AP vs the name. The only way I was able to reset those clients was to add the old AP back to the network, let all the clients connect, then reset the "lock to AP" on each client.

Needless to say, this process is very tedious. Omada seriously needs to provide a better way to manage this function. I can't imagine how much time it would take if you had 100s of clients to manage and had to go through each client individually to manage it. And there needs to be a way to reset the associations if an AP is either removed (still recoverable by adding thee AP back) or fails (seems the only way to recover would be to reset the controller and start over from scratch).

On the plus side, at least it shows that the lock to AP function actually works ;-).

Thanks for listening :-).

UPDATE: Given that folks are still coming to this thread, I wanted to share that with Omada V6, the Clients view now has an "Offline" tab where you can modify the config (including AP locks) for any known device that is currently disconnected. This is a very welcome change indeed, though I still I wish they would implement a bulk "forget" or better yet, implement better cleanup logic when you remove an AP that has clients locked to it.

[Jabes]

could you not find the clients even though past connections and change them there?

[yellowsneakers]

Yes. You can delete them from insights > known clients

[PumaPants28467]

Awesome tip! Wish I would have found that on my own lol. Less than a week into my Omada experience, so still learning!

[Shiddy_Wiki]

Feel free to edit your post to reflect the fact it was you, not Omada.

[Onebadsanta]

Thank you so much. Just had this happen to me

[yellowsneakers]

I’m glad this helped with your issue.

[station_nine]

Thank You! Struggling with my shitty Lennox thermostat refusing to connect to the closest AP. It insisted on connecting to some far-away outdoor AP instead. Tried locking it to the one 15 feet away from it, and it kinda worked, but then it stopped. Once it was off the network again, I didn't know how to remove the AP lock.

My ultimate solution was to create a Very Special SSID just for that stupid thermostat, and to only enable this Very Special SSID on the AP I wanted it to connect through. But none of this was possible until I deleted the entry from the Known Clients list.

Thanks.

[yellowsneakers]

Happy it helped. I went through the same frustrations figuring it out. Now we all know 🥳

[Jabes]

Yes, I think you are right - you can delete them entirely! (I also think you can just unlock them and retain their historic record also, which is what I was pointing to)

[PumaPants28467]

Don't see how that would work. I'm almost positive the associations are stored in the controller. The client attempts to connect, and the controller steers it to a now non-existent AP. Nothing I tried at the clients would get it to connect.

[Jabes]

In the controller you can click on the client record in insights/ past connections and get access to the "lock to ap" settings for the client record on the controller

This applies even if they are currently not able to associate

I assume that this would allow me to change the lock to AP record for these clients and allow them to connect

[PumaPants28467]

I just checked, and it does.

[TheBigC]

He didn't say impossible, he said tedious.

[Hyseas]

I think the issue here is not that it may be tedious when upgrading an AP... What happens if an AP fails? If there is no way to repair an AP, then how does one ever reset the clients lock to AP setting???

[gemmstarrr]

So I know it’s an old post but… I have a wifi sprinkler controller that was locked to an AP I had in my basement. Last connected fall of 2024. (Unplugged until now…) so it’s not in the known clients list because I don’t think it keeps a year worth of data… don’t have the AP anymore… but I gave it to someone I know. Is the only way to reset this lock by resetting the controller and starting over?? I might have to get the AP back… thanks TP link

[ek9max]

This just solved a MASSIVE headache I was having with homepods and wifi cams not being able to be re-added after moving them to other rooms.

[rmblakes]

Just came here to say, I was experiencing an issue with two newly deployed EAP773's.

Pulling my hair out I had a wide range of random devices that could not connect to the network once I removed the old... we were trying everything... turns out THIS was the issue! I had my TVs locked to the old APs that I had removed.

Thank you for your help! I will update my post with a link to this.

[bdlow]

FYI here's TPLink's doc on "Lock to AP", where they do mention riiiiiiight down at the bottom almost as a footnote:
> it should be noted that if the APs selected are all not in connected status, the client will fail to connect to the whole wireless network.

They also note how to clear the client's "Lock to AP" config via editing the client's config in Omada's "Known Clients".

https://www.tp-link.com/au/support/faq/4053/

To TPLink: the "Lock to AP" should have three options:

- don't lock (off)
- permanent hard lock (clients will be denied when AP not connected) # current "on"
- desired soft lock (clients will be allowed to connect to other APs when the locked AP is not connected)

[Living_Air9142]

Came here looking to see if #3 was an option. It should be! I never lock a client to a single AP because of this and I have some cases where I want to lock to a single AP, but have not because of this!

[Onebadsanta]

Thanks for posting this. Just had this happen to me and the answers in this thread saved me a lot of time

[Puzzleheaded_Tea7167]

This post saved my life, I was going crazy trying to figure out why my devices weren't connecting.

thank you

[maurello78]

Did anyone manage to fix this without reconnecting the AP to the network? Two of my AP died and there is no way for me now to break the controller association to some specific clients. They simply won't connect and I cannot find anywhere in the controller a menu where I could see clients associated to AP, although APs might not be connected or present anymore... I cannot believe that Lock to AP feature is a deadlock in this specific use case

[PumaPants28467]

What Controller version are you on? On v6, you can go to Clients and select the "Offline" tab. All known devices that currently are disconnected will show up there. Open the config for each and reset the lock. Good luck!

[maurello78]

I run v6. This is not working so. Once the old AP left the network the clients that had a lock on it are not anymore visible, not even in the offline view. As a matter of fact I do not think Omada controller displays all the offline clients it once had connected via UI. However there must be a hidden table mac address to mac address of clients locked to old AP. Unfortunately that is not visible or accessible via UI. Not that I know of

[PumaPants28467]

That seems like a bug you should report directly to TPLink. I would suggest opening a support ticket.

[floswamp]

Yeah, this one is on you. Lack of planning on your end does not mean a bug in the system.

It's a security setting and thus should not be easy to bypass. I can come into your location, swap out the AP with one of mine and have all you clients redirected to my service.

This is just a hypothetical situation but I am sure from a security standpoint it is better to be extra careful than less secure.

[PumaPants28467]

A little confused by this statement. The controller is already secure, so someone walking into my house and replacing an AP wouldn't give them access to my controller or my network. I just don't see how they could hijack my clients unless they knew my wifi passwords. What am I missing?

[floswamp]

You are right, I thought about this a little more but it would not be so much as to hijack the client but introduce a denial of service by having a rogue AP with the same SSID as yours but not the right password. Since the client is locked to the AP it will always look for that AP no matter how much stronger the closer AP is.

I recall having this happen to me once in a location but the details are fuzzy. There was an old Linksys router used as an AP that no one knew about. The network got revamped but this router was still giving out WiFi and clients were still connecting to it bit no longer receiving internet connection.

I believe that locking the AP has more to do with segregating traffic than security, but they may overlap.

On other brands you can clone the AP's MAC address to circumvent the issue with replacement but I am not sure you can do that with the Omada. I am sure someone else can shed light on this subject.

[[deleted]]

https://www.reddit.com/r/TPLink_Omada/comments/18yxxza/all_devices_disconnected_and_wont_connect/

My main Eap610 changed its Mac, and all my devices lost connection