MikeB wrote

Agreed, but this is sold as a business solution so the controller should check the client MAC and see it's been authorized for the SSID and grant access. The other business WiFi systems handle this. I also have my doubts the EAP system can handle roaming either and if it done by radio MAC then of course it wont.

Of course, yes, since the EAP245 supports band steering, it should be able to handle roaming as well (clients re-connecting using the same ESSID on APs are standardized in 802.11). Yes, they actually use the BSSID of a WiFi adapter (the MAC address) to connect to it, but in search for the BSSID they use the ESSID (WiFi network name).

So if clients gets de-authenticated, it must be caused by the EAPC. According to http://www.tp-link.com/us/faq-928.html, the EAP transmits both, the ESSID and the BSSID to the EAPC auth service, so this could be indeed a major flaw in EAPC authentication scheme.