In brief
A guest logs in at the lobby, walks to the restaurant and gets the portal again. What a session is tied to, the single-SSID rule, 802.11k/r/v and the trouble with mixed AP brands.
A guest logs in with an SMS code in the lobby. They take the lift to the restaurant, the phone joins another access point (AP), and the portal opens again. If the same guest is asked for a third code on the same day, something is set up wrong. This post helps you find it.
What is a session tied to?
The box ties a guest's session to the device's hardware address (MAC) and to the internal IP the box handed to that device. It does not know which AP the device is on, and it does not need to. As long as the session and idle timers have not expired and the same MAC keeps appearing on the same network, no new login is required.
That gives you a rule: if the portal reopens, either the MAC changed, the network changed, or the session timed out. Look for the problem under those three headings.
Rule one: one SSID, one VLAN
Every AP must broadcast the same network name (SSID), the same security setting and the same guest VLAN.
- Different SSIDs: phones generate a separate random MAC per network name. "Guest-Lobby" and "Guest-Restaurant" are two different networks; the box sees two devices and asks both to verify.
- Different VLAN or subnet: if one AP drops guests into another IP pool, the device gets a new IP. The session was bound to the old one, so the portal returns.
- An AP running in router mode: some APs behave like routers out of the box and perform their own NAT. The box then sees all guests as a single MAC, the AP's own. Sessions blur into each other and the records lose their meaning. Every AP must run in bridge (AP) mode.
What 802.11k, 802.11v and 802.11r do
These three standards smooth the hand-over between APs. The phone makes the roaming decision; the AP only helps.
| Standard | What it does | Effect on a guest network |
|---|---|---|
| 802.11k | Gives the phone a list of neighbouring APs | The phone finds the right AP quickly without long scans |
| 802.11v | The AP suggests "move to that AP" | Fixes phones that cling to a weak signal |
| 802.11r | Speeds up re-authentication | Matters on password-protected networks; limited effect on an open guest SSID |
If your APs offer these options, turn them on. Hand-overs get shorter, the phone switches APs without dropping, and the box never notices.
Why mixed AP brands cause re-logins
Single-brand APs managed by one controller apply the same rules. When brands are mixed, this happens:
- Uneven standard support. One AP sends 802.11v hints, the other ignores them. The phone roams smoothly in one direction and abruptly in the other.
- No channel and power plan. Two APs on the same channel interfere. The phone drops and reconnects. If the gap exceeds the idle timeout, the session ends.
- Different sticky-client thresholds. Brand A lets a phone go at a weak signal, brand B holds on. The phone loses packets; the user toggles Wi-Fi off and on, which on some phones means a fresh MAC.
- One in bridge mode, one in router mode. The most destructive mistake above usually appears in mixed installations.
The fix is not to make the brands identical; it is to make the settings identical. SSID, security, VLAN tag, bridge mode and channel plan must match on every AP.
Device remembering: your safety net
Even if a session drops, the portal stays away as long as the box recognises the device; the guest goes straight online. The remember period is set per plan template. Our lab suggestions:
- Hotels, serviced apartments, dormitories, hospitals: 7-day remembering, 24-hour sessions.
- Offices and staff networks: 30-day remembering, 10-hour sessions.
- Cafes and shops: short remembering; guests come and go within the day anyway.
Remembering is tied to the MAC, so it stops working if the phone's private Wi-Fi address changes. That is rare; the address stays fixed unless the guest forgets the network.
Checklist
| Check | How to look |
|---|---|
| Same SSID on every AP? | AP admin screen; capitalisation included |
| Every AP in bridge mode? | DHCP server off, NAT off on the AP |
| Same guest VLAN tag on every AP? | Switch port and the AP's SSID settings |
| Does the IP change while roaming? | Compare the IP in the phone's Wi-Fi details in the lobby and the restaurant |
| Does the idle timeout tolerate a hand-over? | Raise it if it is under 10 minutes |
| Are 802.11k/v enabled? | The AP's wireless settings |
Example scenario
Picture a fictional hotel: one AP brand in the lobby, another on the floors. The complaint is always the same: the portal reopens when guests go up to their rooms. The first suspect is the remember period; but it is set to 7 days, so that is not it. A test shows the phone's IP is 10.10.x in the lobby and 192.168.x in the room. The floor APs were left in router mode, handing out their own addresses. Once switched to bridge mode with the guest VLAN tag, the phone keeps the same IP everywhere and the portal never returns. The only change was on the APs; the box was not touched.
If your APs support RADIUS, they can also talk to the box over RADIUS, which makes session details visible on the AP side too. Most small businesses do not need it; a single SSID and bridge mode are enough.
The box keeps the session, the APs handle the hand-over. When the two speak the same language, a guest verifies once a day and never sees the portal again. See the industry guides for hotel and dormitory setups, and the box page for how the box works independently of AP brand.