Strange SSL and Security errors depending of the Wifi network used

[OlivierGre]

I have a question regarding these errors:

In Android commissioner:
[kSecurity] : SSL - A fatal alert message was received from our peer

In OTBR Syslog:
[W] Mle-----------: Failed to process Discovery Request: Security

I have already faced those errors in the past and successfully fixed them (I had asked for advices here and here)

We are now experiencing a strange error:

Last week I have prepared a setup containing a Raspberry Pi connected to a RCP + A Thread Joiner device + a wifi access point (not connected to internet). I have tested that Thread commissioning works and sent the devices to a colleague in another country.

He has received the demo but he was not able to do a successful commissioning: He always had an SSL error on the Android phone and "Failed to process Discovery Request: Security" in the OTBR syslog.
The only change comparing to the setup that I have tested last week is the Android phone. We use the same APK but it is a different phone.
When we have such problem, I usually run a script on the OTBR to set the Dataset and ensure that we have the expected one (the commissioner credential used in Android app corresponds to the ones used to generate the pskc). Usually it solves the problems but here it didn't.
He has tried 2 different Wifi Access Point: A TP-link wifi access point (not connected to internet) and a smartphone Wifi access point (connected to internet). Same result with both.

This afternoon, he went home and has installed the demo, using his home wifi network. Surprinsingly, it worked fine!
He has changed nothing but the wifi network. Do you understand what could have happened?

If he changes the Wifi access point and uses the TP-link wifi access point or his smartphone Wifi access point, the issue is back.
How can we explain that the commissioning works on a wifi network and doesn't work on another?

Thank you

[jwhui]

This error:

[W] Mle-----------: Failed to process Discovery Request: Security

occurs when a Router receives a Discovery Request message and the Thread Network Data indicates that there is no active Commissioner or there are no Joiners in the current Steering Data TLV (i.e. Joiners added by the Commissioner).

This likely means that the commissioner is not properly communicating with the Thread Border Agent on the border router. But without any more visibility into your network, it is difficult to determine why.

[OlivierGre]

Hi Jonathan,
Thank you. We're going to do more tests to characterize the problem. The smartphone was an "IPhone 12 mini". I'm wondering if something could be missing in it about IPV6 support. We will try some other phones to narrow the issue.

I agree with your explanation that the commissioner is not communicating properly with the Openthread Border Router. We will analyze what the syslog contains when the commissioner does the Petitionning.
I'm also wondering if, once the meshcop service found, it would be wise that the commissioner pings the OTBR to check that the communication is OK before trying to do the commissioning.

Regards

[OlivierGre]

Unfortunately, I was not able to do more tests with the failing configuration. I know that the person who used the demo had switched a few times between 2 Wifi network so it is possible that the IPV6 address indicated in the meshcop service was for the previous wifi network. That would explain that the commissioner doesn't succeed to contact the OTBR.
I have never had this problem during my test so I'm thinking to something like that.