Zooz Zen26 can no longer be included with Security=None

I've submitted a ticket to Hubitat Support, but realized I should also check in with the community.

Background: I join all of my z-wave devices to my Hubitat C7 with Security=None. I do this because devices joined using security="S2 Unauthenticated", or any of the other S2 modes, tend to lock up after several days of use. I've seen this "lock up" behavior on both Zooz and Honeywell/Jasco in-wall switches. With Security=none, I've never had a problem.

Current problem: I am suddenly unable to join ZEN26 switches with Security="none". It always shows up as security="S2 Unauthenticated ''. I've tried excluding, resetting and re-including the switch multiple times -- same outcome.

I've also noticed a change in the way the inclusion process works -- I think this happened when the hub updated to firmware version 2.2.8.x.

Previously, during the inclusion process I would get a screen where I could select the security mode. If I unselected all of the check boxes / options, the switch would join with Security="None".

Now, I get the screen that is in the screenshot below. The switch joins with security="S2 Unauthenticated" weather I hit the "Skip" or "Confirm" button.

Interestingly, my ZEN72 joined the network with security=none when I selected "skip".

I wrote Zooz support -- they indicated they have not seen this problem before (can't join with security=none) and suggested I contact Hubitat support. I've submitted a ticket to them, but thought it would be a good idea to also check in with the community.

My hub is a hubitat C7.
Hubitat Elevation® Platform Version
2.2.8.156
Hardware Version
Rev C-7

Thank you in advance for any help you can provide!

Marc

I recently had the exact same problem trying to add a Zen30.

I don't know how, but I kept fighting with it, include/exclude/factory-reset multiple tries. I messed with it for several days and then one time I got lucky and it paired with no security. I wish I could tell you how or why but I don't know how it eventually worked.

I'm just replying to confirm I was having the same problem and highly suspect I would have the same problem again if I excluded and tried to re-join it.

Thanks to both Mark and Carl for replying.

Carl -- the latest release does not provide the opportunity to enter the first 5 digits -- it has them already filled in -- so that is no opportunity to enter "00000".

I received the following reply from Hubitat support:

Thank you for reaching out to us. This is a known issue for a few devices that don't properly support S2 authentication. The issue you reported with Zen26 has been referred to our engineering team and we will reach out to you if additional details about this incident are needed.

@agnes.zooz, I am threading you in for help on this.

  • Zooz support indicated that they had not seen the issue before and referred me to Hubitat support.
  • Hubitat support is indicating that there is an issue with the way the ZEN26 support S2 authentication.

I fear that I may get caught in a loop between the 2 organizations. Do you have contacts at Hubitat that your folks can work with to get this solved?

Thanks in advance for any help you can provide!

Marc

The ZEN26 device supports S2 Unauthenticated security only. That being said, when it was first integrated to HE, the platform didn't support S2 at all so it's possible that the driver needs to be updated to accommodate all S2 features. Have you tried using the custom community driver to see if it could help here?

Hi @agnes.zooz, thank you for replying!

I am using the community driver, authored by @jtp10181. I include it using the Hubitat package manager. I am on version 1.4.4 of the community driver, per the code pasted below.

Marc

/*
 *  Zooz ZEN On/Off Switches Universal
 *    - Model: ZEN21, ZEN23 - MINIMUM FIRMWARE 3.04
 *    - Model: ZEN26 - MINIMUM FIRMWARE 2.03
 *    - Model: ZEN71, ZEN73, ZEN76 - All Firmware
 *
 *  Changelog:

## [1.4.4] - 2021-06-08 (@jtp10181)
  ### Added
  - Full supervision support for outgoing Set and Remove commands
  - Toggle to enable/disable outbound supervision encapsulation
  - Associations update with Params Refresh command so you can sync if edited elsewhere
  ### Changed
  - Code cleanup and standardized more code across drivers

@agnes.zooz, a quick follow-up.

I use Security="None" based on advise from Zooz Support. When I reported problems with my ZEN26 locking up, you folks indicated that using Security="None" instead of "S2 unauthenticated" would solve the problem, and you were correct. I have not had a lockup since I made that change sometime back.

Have things changed since then and would you now expect the ZEN26 to be stable with Security="S2 Unauthenticated" using a Hubitat C7 hub?

Thanks!

Marc

The inclusion problem is from Hubitat new firmware release. They tried to simplify the inclusion process as a lot of people were confused about the checkboxes, but in doing so they eliminated the choices. Another thread I saw people asking for an advanced inclusion that brought back all the options like before so maybe Hubitat will add it back.

As for the S2 support, my driver you are using has always supported S2. I have also had a few random device lockups out of about a dozen various Zooz switches, but not very frequently. Not sure what causes it but there must be something going on in either with the C7 radio or the device firmware that is locking it up.

5 Likes

As @jtp10181 mentioned, it's hard to say exactly what's causing the lock-up and without being able to reliably replicate it, there's no way for us to make changes to the firmware. All of our Z-Wave devices are fully certified so the S2 part should be up to the Z-Wave standard but small bugs can always slip through. We'll keep looking.

But it's really bad news that the security inclusion choice is no longer there for HE...

2 Likes

My 2 cents, might be worth purchasing/using a UZB stick for inclusion without security!

3 Likes

Interesting. How do I use a USB z-wave stick with the Hubitat C7 hub? Also, can I remove the USB stick once the device is included into the network?

Marc

There are several great threads on this forum on selecting and using a Z-Wave (UZB) stick to act as a secondary Z-Wave controller which allows one to join devices without unnecessary security. Just search for these threads using UZB or 'Z-Wave stick'.

After joining Z-Wave devices using the paired UZB, one can then exclude the UZB if they desire and the HE Hub has them defined for use without security.

2 Likes

I have not hit this issue yet - besides fighting with my lock I haven’t included anything new since 2.2.8 came out.

But soon I am going to be replacing two zen26s with zen76s and moving the 26s to other spots. And I have three more zen26s on the shelf to be deployed. So I will be up against this issue soon.

Besides my lock and my ring S2 extenders, everything on my mesh is joined w/o security.

I am surprised HE has not yet commented here.

@bcopeland I know previously the unofficial response has been if you don’t need S2, then don’t use security. I also believe that you are probably the biggest staffer using S2.

Are their plans to give us older gen the option again in the next release?

1 Like

If that is true then Hubitat made a big mistake. Give us the ability to choose!

YES PLEASE

2 Likes

Well I think they did, the use of the skip button is supposed to include without security. Or at least that’s my understanding of what skip means in this context.

The mystery is why that doesn’t work on this specific device. I suspect if skip wasn’t working at all we would be seeing a lot more complaints.

1 Like

Definitely works for GE/Jasco Enbrighten switches. I paired 4 the other day and skip set security to none.

I do have a few Zen26s paired with no security to my C7 hub that I paired many months ago. Maybe the latest firmware broke this, not sure.

I just re-included a Zen22 last night that I pulled out of another location months ago.

I hit “skip” at the security screen and I definitely got security.

I am not impressed.

Can anyone point me to the post that explains how to in include a device with no security using PC controller?

I have searched but can’t find it.

You first pair the uzb secondary controller device with HE - I use "Classic Learn Mode" - On the HE the device should show up as a "Device" this is fine... as an aside I hit "skip" during the pairing process and it paired with no security.

From there you simply do a Network Wide Inclusion (NWI) and put your device into pairing mode. A popup box with security options should appear. If you have any difficulty I believe you can click on the shield icon on the upper right of the window and uncheck the security options you don't want.. and try again. You can also do a Network Wide Exclusion (NWE) and exclude the device.

On the HE side, you can reboot and/or go into z-wave details and hit discover or go into z-wave inclusion mode and it should appear. One or a combo of these - sometimes the device will just appear...

Note: you cannot include devices WITH S2 security and the secondary controller - something about the credentials not getting transferred..

1 Like

Yes I do remember reading this previous.

Thank you for the step-by-step.

1 Like

One would think that, but its not what happens with the Zooz Zen30 that I tried. 'Skip' got me S2 Unauthenticated, but that's not the same as 'no security'

Yep, that's the same thing I saw.