@Virgo Any config change gets devices connected back to the AP for about a day. My current workaround is to disable 2.5GHz on the EAP650 which forces all 2.4Ghz clients to connect to the EAP610-Outdoor which is much further away... so distance is not an issue... The EAP650 has no issues after a reboot or a config change until about a day later... then the 2.4Ghz client get stuck... Clearly this seems to be an issue with the EAP650 getting "Stuck" somehow... 

  @unrly 

I have tried per access point seperated SSID's for 2.4GHz too, without success unfortunately.

Also binding a client to an access point does not help.

With my previous access points (HP Aruba) this was never a problem.

It is not a client related problem, it is an access point problem.

Rebooting the affected access point solves the problem (for a short time) or making a configuration change solves it too.

Mesh is disabled, I don't use mesh.

  @-RB- 

Sorry to hear that didn't work, as I mentioned I had the same issues and locking it to the AP was the only thing that fixed it. Rebooting the device or AP would help for a short time, but nothing helped except the lock. I agree that it's an AP issue, as I used Asus mesh and Orbi mesh devices and never had problems with these devices until I rolled out Omada in my home.

Good luck

  @unrly 

Thank you for your suggestions, I will keep trying to find the working combination.

Also I hope TP-Link is going to step up to fix this very basic functionality.

It is crazy that this is not working stable.

Just to let you guys know;

I have replaced the three EAP670 access points with three EAP660-HD access points, and the "WPA Authentication Timeout or Failure" problems seems to be gone!

All IoT clients are connected now for 10 days on 2.4GHz without problems.

So it seems to be related to the used wifi-chipset in the EAP650/670 access points in combination with a huge firmware bug.

@Fae @Hank21   

Please TP-Link, get this issue solved, this is very basic wifi connectivity that should work without problems!

  @Fae 

Thank you for replying on this topic.

I have checked the client signal strength on the EAP670 and the EAP660-HD and there is really not much difference. Believe me, signal strength is not an issue in this setup. Clients that are experiencing these disconnects due to WPA Authentication Timeout or Failure are between 1 and 7 meters a way from the nearest access point.

Since I have replaced the AP's everything is running stable without disconnects.

As you can read on this topic, every possibility have been tried, it is time for TP-Link to take over and fix this basic functionality.

  @Fae Perhaps you haven't read the other comments in the thread... There is most certainly a problem with the EAP650 (and maybe other devices), after about 1 day the 2.4Ghz devices drop off the network and the logs are filled with  "WPA Authentication Timeout or Failure". If I turn off the 2.4Ghz radio on the EAP650 then the devices connect to my EAP610-Outdoor which being outdoors is much further away from all these IoT devices inside the house. They remain connected to the EAP610-Outdoor essentially forever with very low signal.

I was really hoping that by starting this thread it would get the ball rolling on a fix. It's frustrating to get yet another answer blaming poor signal. How do we get in touch with the TP-Link bug team? This should be VERY easy to replicate now that several people have experienced the same issue. 

Seems like this is dead, but I'll just add on for the record, even though they don't seem to care.  EAP670, same issues.  2.4Ghz devices stop working, same WPA Authentication Timeout or Failure errors.  Rebooting or making a change seems to fix it for a day or two.  I have noticed forgetting the AP so it factory defaults and re-adopting seems to get it working for up to a month or two... usually.  Sometimes it still only lasts a day or two.

Only a single AP, so no mesh.  Small single bedroom apartment, so no distance issues.  2.4 has a longer range than 5 anyway, so obviously if 2.4 is having regular signal issues 5 would as well, but that is not the case.

Also most of the 2.4 stuff is IoT stuff that does not move.  TVs, chromecasts, my robot vacuum's dock, my bed.  If this was a signal issue, then they wouldn't be working for a month and then start getting the WPA Authentication errors suddeny all together.  My bed certainly did not move out of signal range.

Anyways, I'm not expecting them to do anything, just figured I'd add another data point on the off chance they actually decide to maybe look more at it instead of reading a list of pre-prepared wireless troubleshooting tips and claiming it isn't their issue.