Wireless Roaming — L2, L3, Fast Transition (802.11r), OKC, and Mobility Groups

Roaming basics

The client — not the AP or WLC — decides when to roam. Its NIC watches signal strength, retry rates, and background scans, and jumps to a stronger AP when a threshold is hit.

The AP + WLC job is to make that jump fast — under 50 ms if voice / real-time is on the SSID.

Layer-2 roaming (intra-controller, same subnet)

Simple case:

• Client associated with AP-1, IP 10.10.5.42/24.
• Roams to AP-2 (same VLAN 5, same subnet).
• WLC just updates its client entry pointing at AP-2.
• Client keeps IP, keeps TCP sessions.

No mobility tunnel needed. Handoff time depends on the auth method:

• Open SSID / PSK — a few tens of ms.
• 802.1X full auth — 200-500 ms without acceleration. Too slow for voice.

Layer-3 roaming (inter-controller / different subnet)

Harder case:

• Client on AP-1 (VLAN 5, 10.10.5.0/24), WLC-1.
• Roams to AP-2 (VLAN 6, 10.10.6.0/24), WLC-2.
• If we just re-DHCP, the client’s 10.10.5.42 IP goes stale. Every open TCP session breaks.

Solution: mobility tunnel between WLC-1 and WLC-2:

• WLC-1 = anchor controller (holds the client’s original subnet).
• WLC-2 = foreign controller (where the client physically is now).
• Traffic to/from the client is tunneled between WLC-2 (foreign) and WLC-1 (anchor). Client thinks it’s still on VLAN 5.

Mobility groups + domains

• Mobility group = a set of WLCs that share security keys and can do fast, cached-context L3 roaming. Typically same physical campus.
• Mobility domain = larger — allows roaming between groups but slower / less caching.

Configure the same mobility group name + IP list on every WLC that shares a group.

Fast roaming techniques (fixing 802.1X slowness)

OKC — Opportunistic Key Caching (Cisco proprietary)

• On first 802.1X auth, the WLC caches the PMK.
• When the client roams to a different AP (on the same WLC), the WLC hands the cached PMK to the new AP.
• No new 802.1X exchange — just a 4-way handshake to derive PTK. Handoff drops to ~50 ms.

Works with WPA2. Not standardized.

802.11r — Fast Transition (FT)

• IEEE standard. Client and WLC do “pre-authentication” work with target APs while still on the current AP.
• New PTK is derived over the current channel, so the actual roam is just a re-association + handshake — sub-50 ms.
• Two flavors: FT over-the-air (client talks to the new AP directly) and FT over-the-DS (client tunnels through its current AP to the new AP).

Voice devices (Cisco 7925/8821, iPhone) support 802.11r natively.

802.11k — Neighbor reports

• AP tells the client “here are your neighbor APs, sorted by RSSI.” Client scans fewer channels → picks the right target faster.
• Doesn’t accelerate the handoff itself, but reduces the time spent deciding.

802.11v — BSS Transition Management

• WLC can request a client to move to a specific AP. Encourages load balancing.
• Modern clients honor it.

Modern voice / real-time SSIDs enable 802.11r + 802.11k + 802.11v together.

Sample WLC configuration (Cisco 9800)

wireless profile policy corp-policy
  wpa2-fast-transition adaptive        ! enable 802.11r
  neighbor-list-dual-band              ! 802.11k
  bss-transition                       ! 802.11v
  fabric-mode                          ! (optional)

wireless mobility group name campus-mobility
wireless mobility group member ip 10.0.0.20 public-ip 10.0.0.20  ! peer WLC

Verifying

show wireless client mac <MAC> detail
show wireless mobility summary
show wireless mobility peer-client-summary

Look for Fast Transition = Enabled, Mobility Role = Local / Anchor / Foreign.

Common exam / real-world mistakes

1. Enabling 802.11r on the same SSID as legacy clients. Old clients that don’t understand FT can’t associate — they see FT-only beacons as unsupported. Use adaptive FT so both work.
2. Skipping mobility groups. Client roams between WLCs and gets a new IP → open sessions die. Configure mobility groups so anchor/foreign roaming kicks in.
3. Different VLAN IDs across WLCs in a mobility group. For L3 roaming to work, the client subnet must exist as an anchor on the original WLC. Mismatched VLAN plans break this.
4. Trusting the client to roam smartly. Some clients are terrible (“sticky”). 802.11v BSS Transition helps push them.
5. Forgetting CoPP / firewall between WLCs. Mobility uses CAPWAP-derived TCP + UDP (16666, 16667, EOIP GRE). Firewalls between WLCs will silently drop these.

Cheat strip

L2 roam    same VLAN. WLC just updates client-AP mapping. Fast.
L3 roam    different VLAN. Anchor + foreign WLCs tunnel client traffic.

Fast roam:
  OKC       Cisco cache PMK. Sub-50 ms. WPA2.
  802.11r   IEEE Fast Transition. Sub-50 ms. WPA2/3.
  802.11k   neighbor list. Client scans fewer channels.
  802.11v   BSS Transition. WLC guides client to a target AP.

Roles      Local  |  Anchor (owns subnet)  |  Foreign (client is here)
Mobility   group = same-campus + cached keys.  domain = wider, slower.

Verify     show wireless client mac X detail
           show wireless mobility summary