Can connect to guest network but not the main one with encryption

[Hash]

Hi, I have a phone that can connect to encrypted guest network but not the main one. Without encryption, either network works fine; with encryption, the phone cannot pass the main network authentication but has no problem passing the guest network authentication. This authentication issue is consistent with AES or TKIP, with WPA or WPA2, and with 2.4GHz or 5GHz channel. I tried all encryption/channel combinations. The problem happened with Merlin 378.50 but updating to 378.53 did not fix it.

I know that this is most likely a device dependent issue, but I thought the Merlin firmware may have a setting may solve this problem. The problem happens with any combination of the following settings:

Router: RT-AC68U
Merlin firmware versions: 378.50 and 378.53
Main network channels: 2.4GHz and 5GHz
Encryption: WPA/WPA2, AES/TKIP
MAC filter: on or off

Phone: LG Nexus 5 with Android 5.1.1.

Again, this problem only happens in the main network but not the guest network. The only difference is that I disable LAN connection in the guest network. Any insight is appreciated.

 

[kbp]

Check your firewall settings / try without firewall on.

 

[john9527]

I don't know if this applies to your configuration, but you can't mix 'Legacy' mode with another mode between the guest and primary networks.
That is, if you want your guest network to support legacy devices, your primary network must also be limited to selecting legacy mode and its encryptions/speeds.

 

[Hash]

Thanks for your suggestions, guys. The problem turns out to be 'Protected Management Frame'. I had it at 'Enabled' thinking it would be more secured. 'Required' caused the same authentication problem. It worked with most of my phones and computers but not the Nexus 5. Changing to 'Disabled' solved the problem. It seems like 'Enabled' is not exactly making 'Protected Management Frame' optional. It also means that Guest Network doesn't have the same 'Protected Management Frame' process.