diff --git a/src/core/agent.c b/src/core/agent.c
index 13fd0c72f46b91d4569484f70d3bc78392a5b1c5..3112e5cbf40d769afb5a24248913f3607d9710e0 100644
--- a/src/core/agent.c
+++ b/src/core/agent.c
@@ -73,10 +73,12 @@ static void bsta_steer_cb(struct uloop_timeout *t)
 	struct netif_bk *bk = container_of(t, struct netif_bk, connect_timer);
 	uint8_t *bssid = NULL;
 
-	if (hwaddr_is_zero(bk->bsta_steer.prev_bssid))
-		bssid = bk->bsta_steer.prev_bssid;
+	dbg("|%s:%d| steer timer expired, restoring old bssid (" MACFMT ") for"\
+			"bsta %s\n",
+			__func__, __LINE__, MAC2STR(bk->bsta_steer.prev_bssid),
+			bk->name);
 
-	wifi_set_iface_bssid(bk->name, bssid);
+	wifi_set_iface_bssid(bk, bk->bsta_steer.prev_bssid);
 }
 
 static void agent_terminate(void)
@@ -3500,7 +3502,7 @@ static void parse_bk(struct ubus_request *req, int type,
 	char bssid[18] = { 0 };
 	struct blob_attr *tb[1];
 	static const struct blobmsg_policy ap_attr[1] = {
-		[0] = { .name = "bssid", .type = BLOBMSG_TYPE_STRING }
+		[0] = { .name = "macaddr", .type = BLOBMSG_TYPE_STRING }
 	};
 
 	blobmsg_parse(ap_attr, 1, tb, blob_data(msg), blob_len(msg));
@@ -4255,6 +4257,7 @@ static void mapclient_subscribe_for_cmdus(struct agent *a)
 			CMDU_TYPE_AP_AUTOCONFIGURATION_SEARCH,
 			CMDU_TYPE_AP_AUTOCONFIGURATION_RESPONSE,
 			CMDU_TYPE_AP_AUTOCONFIGURATION_WSC,
+			CMDU_BACKHAUL_STEER_REQUEST,
 			-1);
 
 	trace("<----------------------------------- %s\n", __func__);
diff --git a/src/core/agent_cmdu_generator.c b/src/core/agent_cmdu_generator.c
index 33c1b74e9913c328d4cf1cefab507b19cd9a0d69..cb2d25bfad58e9cd39cbb18dec736f35501d80ee 100644
--- a/src/core/agent_cmdu_generator.c
+++ b/src/core/agent_cmdu_generator.c
@@ -1110,7 +1110,7 @@ int agent_gen_cmdu_backhaul_steer_resp(struct agent *a, uint8_t *target_bssid, u
 	if (ret)
 		goto out;
 
-	trace("build ap autoconfig wsc!\n");
+
 	cmdu_put_eom(frm);
 	cmdu_set_mid(frm, mid);
 	return frm;
diff --git a/src/core/agent_map.c b/src/core/agent_map.c
index ee12475328c71efd21175b47b0e16a61ccd4b37d..4601500699f3cd27154e614d3c5d73bf38c95dd8 100644
--- a/src/core/agent_map.c
+++ b/src/core/agent_map.c
@@ -3168,7 +3168,7 @@ int handle_backhaul_sta_steer_request(void *agent,
 	if (!tv[0][0])
 		return -1;
 
-	req = (struct tlv_backhaul_steer_request *) tv[1][0]->data;
+	req = (struct tlv_backhaul_steer_request *) tv[0][0]->data;
 	if (!req)
 		return -1;
 
@@ -3184,65 +3184,13 @@ int handle_backhaul_sta_steer_request(void *agent,
 		cmdu_free(bk->bsta_steer.cmdu);
 	bk->bsta_steer.cmdu = cmdu;
 
-	wifi_set_iface_bssid(bk->name, req->target_bssid);
-	uloop_timeout_set(&bk->connect_timer, BSTA_STEER_TIMEOUT);
+	wifi_get_iface_bssid(bk->name, bk->bsta_steer.prev_bssid);
+
+	wifi_set_iface_bssid(bk, req->target_bssid);
+	uloop_timeout_set(&bk->connect_timer, 20 * 1000); /* TODO: why the long timeout */
 
 	memcpy(cmdu->origin, rx_cmdu->origin, 6);
 	return 0;
-//	struct agent *a = (struct agent *) agent;
-//	struct tlv_backhaul_steer_resp *p;
-//	struct tlv_backhaul_steer_req *req;
-//	struct cmdu_cstruct *cmdu;
-//	struct netif_bk *bk;
-//
-//	req = (struct tlv_backhaul_steer_req *) extract_tlv_by_type(rx_cmdu,
-//			MAP_TLV_BACKHAUL_STEERING_REQUEST);
-//	if (!req)
-//		return -1;
-//
-//	bk = find_bkhaul_by_bssid(a, req->addr);
-//	if (!bk)
-//		return -1;
-//
-//	cmdu = (struct cmdu_cstruct *)calloc(1,
-//			sizeof(struct cmdu_cstruct));
-//	if (!cmdu) {
-//		fprintf(stderr, "Out of memory!\n");
-//		return -1;
-//	}
-//
-//	cmdu->message_type = CMDU_BACKHAUL_STEER_RESPONSE;
-//	memcpy(cmdu->origin, rx_cmdu->origin, 6);
-//	cmdu->message_id = rx_cmdu->message_id;
-//	strncpy(cmdu->intf_name, rx_cmdu->intf_name, sizeof(cmdu->intf_name));
-//
-//	p = calloc(1, sizeof(struct tlv_backhaul_steer_resp));
-//	if (!p)
-//		goto out_cmdu;
-//
-//	p->tlv_type = MAP_TLV_BACKHAUL_STEERING_RESPONSE;
-//	memcpy(p->bssid, req->bssid, 6);
-//	memcpy(p->addr, req->addr, 6);
-//
-//	cmdu->num_tlvs++;
-//	cmdu->tlvs = (uint8_t **)calloc(cmdu->num_tlvs, sizeof(uint8_t *));
-//	if (!cmdu->tlvs)
-//		goto out_p;
-//
-//	cmdu->tlvs[0] = (uint8_t *) p;
-//
-//	if (bk->bsta_steer.cmdu)
-//		map_free_cmdu(bk->bsta_steer.cmdu);
-//	bk->bsta_steer.cmdu = cmdu;
-//
-//	wifi_set_iface_bssid(bk->name, req->bssid);
-//	uloop_timeout_set(&bk->connect_timer, BSTA_STEER_TIMEOUT);
-//	return 0;
-//out_p:
-//	free(p);
-//out_cmdu:
-//	free(cmdu);
-//	return -1;
 }
 
 void free_scanresults_neighbors(struct wifi_radio_element *re)
diff --git a/src/core/config.c b/src/core/config.c
index 656053bc0eed89d7877014297add80aecead948d..3207b929fa969d00ec98343a24f5af2a01545f31 100644
--- a/src/core/config.c
+++ b/src/core/config.c
@@ -212,9 +212,45 @@ char *uci_get_bridge(char *ifname, char *bridge)
 	return bridge;
 }
 
+int wifi_get_iface_bssid(char *ifname, uint8_t *bssid)
+{
+	struct uci_context *ctx = NULL;
+	struct uci_package *pkg;
+	struct uci_section *section;
+	struct uci_ptr ptr = {0};
+	int ret = -1;
+
+	if (!bssid)
+		return ret;
+
+	pkg = uci_load_pkg(&ctx, "wireless");
+	if (!pkg)
+		return ret;
+
+	section = config_get_section(ctx, pkg, "wifi-iface", "ifname", ifname);
+	if (!section)
+		goto out_pkg;
+
+	ptr.p = pkg;
+	ptr.s = section;
+	ptr.option = "bssid";
+	ptr.target = UCI_TYPE_OPTION;
+
+	ret = uci_lookup_ptr(ctx, &ptr, NULL, false);
+	if (!ret && ptr.o)
+		hwaddr_aton(ptr.o->v.string, bssid);
+	else
+		memset(bssid, 0, 6);
+
+out_pkg:
+	uci_unload(ctx, pkg);
+	uci_free_context(ctx);
+	return ret;
+}
+
 
 /* TODO: can it be generalized? */
-int wifi_set_iface_bssid(const char *ifname, uint8_t *bssid)
+int wifi_set_iface_bssid(struct netif_bk *bk, uint8_t *bssid)
 {
 	struct uci_context *ctx = NULL;
 	struct uci_package *pkg;
@@ -226,12 +262,14 @@ int wifi_set_iface_bssid(const char *ifname, uint8_t *bssid)
 	if (!pkg)
 		return ret;
 
-	section = config_get_section(ctx, pkg, "wifi-iface", "ifname", ifname);
+	section = config_get_section(ctx, pkg, "wifi-iface", "ifname", bk->name);
 	if (!section)
 		goto out_pkg;
 
-	if (bssid && !hwaddr_ntoa(bssid, bssid_str))
-		goto out_pkg;
+	if (bssid && !hwaddr_is_zero(bssid))
+		hwaddr_ntoa(bssid, bssid_str);
+
+	dbg("|%s:%d| setting bssid to %s\n", bssid_str);
 
 	ret = set_value(ctx, pkg, section, "bssid", bssid_str, UCI_TYPE_STRING);
 
diff --git a/src/core/config.h b/src/core/config.h
index fb67881b84e4b08ddeabe793375e0747c9a4c088..b2699039c37d28f473fcef5c62bb8e83e47b5bbb 100644
--- a/src/core/config.h
+++ b/src/core/config.h
@@ -195,6 +195,7 @@ union config {
 #endif
 
 struct agent;
+struct netif_bk;
 
 enum m2_process_status {
 	M2_PROCESS_OK,
@@ -212,7 +213,8 @@ struct uci_section *config_get_iface_section(struct uci_context *ctx,
 		struct uci_package *pkg, const char *type, const char *ifname);
 bool uci_reload_services(char *services);
 struct uci_package *uci_load_pkg(struct uci_context **ctx, const char *config);
-int wifi_set_iface_bssid(const char *ifname, uint8_t *bssid);
+int wifi_get_iface_bssid(char *ifname, uint8_t *bssid);
+int wifi_set_iface_bssid(struct netif_bk *bk, uint8_t *bssid);
 char *uci_get_bridge(char *ifname, char *bridge);
 
 /* END TODO */