A Quick Run-Through of Wi-Fi Roaming Protocols: The Basics

Why can’t a wireless client simply “swap” access points instantly? This article explains the phases of an 802.11 roam, compares Personal and Enterprise security exchanges, and shows how SKC, OKC, CCKM, 802.11r, 802.11k, and 802.11v affect the transition.

1. The Core Objective of Roaming

At its most basic level, roaming moves a client association from one BSS to another within an ESS while keeping interruption as short as possible. The complete process can involve candidate discovery, 802.11 authentication, reassociation, security validation, key establishment, client-state updates, and data-path changes.

A full Enterprise authentication during every roam can introduce enough delay to affect voice calls, video, and applications with short timeout windows. Fast secure roaming mechanisms reduce that delay by reusing or deriving key material without repeating the complete EAP exchange.

Personal vs. Enterprise Security During a Regular Roam

WPA2-Personal / PSK

Discovery or cached candidate information
                |
802.11 Open System Authentication
                |
Reassociation Request / Response
                |
WPA2 4-Way Handshake
                |
Protected data traffic

With WPA2-PSK, the client and infrastructure already have the key material needed to establish a fresh pairwise security association. A regular roam still uses a new 4-Way Handshake with the target AP.

WPA2-Enterprise / 802.1X

Discovery or cached candidate information
                |
802.11 Open System Authentication
                |
Reassociation Request / Response
                |
802.1X / EAP authentication through the authenticator
                |
WPA2 4-Way Handshake
                |
Protected data traffic

Without a supported fast-roaming method and valid cached key material, an Enterprise client repeats EAP authentication and then completes the 4-Way Handshake. The delay varies with the EAP method, certificate validation, client behavior, RF conditions, retransmissions, AAA-server latency, and network round-trip time.

Why Key Caching and Key Derivation Matter

The goal of fast secure roaming is to avoid repeating the most expensive authentication work. Depending on the method, the client and infrastructure reuse a cached PMK, derive AP-specific keys from an FT hierarchy, or complete a proprietary abbreviated exchange.

Not every fast-roaming method “shortens” the same exchange:

• SKC and OKC skip the full EAP exchange but still use a standard 4-Way Handshake.
• CCKM derives the new keys through its proprietary reassociation process and avoids a separate roam-time 4-Way Handshake.
• 802.11r integrates FT authentication and key confirmation into the FT and reassociation exchanges rather than performing the ordinary post-reassociation 4-Way Handshake.

2. Authentication-Acceleration Methods

• First visit to a new AP: full EAP authentication is required.
• Return to a cached AP: the client includes a PMKID; if the infrastructure has the matching PMK, EAP is skipped.
• Key exchange: the normal 4-Way Handshake still creates fresh transient keys.
• Catalyst 9800: SKC is not supported.

• Benefit: a first roam to a new AP may skip EAP without requiring a previous association to that AP.
• Key exchange: the normal 4-Way Handshake still occurs.
• Scope: the cache must be available within the controller or correctly configured mobility/FlexConnect domain.
• Catalyst 9800: OKC is supported and enabled by default in applicable configurations; FT-only or CCKM configuration changes the available method.
• Compatibility: OKC is not defined by the IEEE 802.11 standard, so client support varies.

• Initial join: the client performs its full Enterprise authentication and establishes the CCKM key hierarchy.
• Roam: the reassociation exchange contains enough protected information for the client and infrastructure to derive the new PTK.
• Benefit: it avoids full EAP and a separate roam-time 4-Way Handshake.
• Use case: legacy Cisco voice clients, Workgroup Bridges, and other validated CCX devices.
• Limitation: proprietary client support makes it a specialized legacy option rather than the default standards-based design.

3. 802.11r Fast BSS Transition

802.11r defines a standards-based FT key hierarchy using PMK-R0 and PMK-R1 derivatives. The target AP can obtain or derive the necessary key context without repeating the original EAP authentication.

During an FT roam, authentication and key confirmation are incorporated into FT authentication/action frames and the reassociation exchange. It is therefore more precise to say that FT avoids the ordinary post-reassociation 4-Way Handshake, rather than saying that it performs no handshake or no key exchange.

• Supports Enterprise and Personal FT AKMs where the client and infrastructure support them.
• Can be used with modern security modes, including supported FT-SAE designs.
• Requires a consistent FT mobility domain and compatible controller/AP configuration.
• Client compatibility must be tested, particularly for older and embedded devices.

FT Over the Air vs. Over the DS

• Over the Air: the client exchanges FT authentication frames directly with the target AP. This is the default C9800 method.
• Over the DS: the client sends FT action frames through its current AP and the distribution system toward the target AP. Not every client supports this mode.

Mixed Mode

WPA2-Enterprise example:
Standard 802.1X AKM + FT-802.1X AKM

WPA2-Personal example:
PSK AKM + FT-PSK AKM

Fast Transition: Enabled
Over-the-DS: Disabled unless specifically required and validated

FT-capable clients select the FT AKM. Non-FT clients can select the standard AKM. A non-FT Enterprise client may use OKC if both the client and infrastructure support it, but that fallback should not be described as guaranteed for every legacy client.

4. Assisted Discovery and Steering

FULL ROAMING PROCESS
        |
        +-- Discovery and candidate selection
        |      802.11k can provide candidate information
        |      802.11v BTM can suggest a transition
        |
        +-- Secure transition
               SKC / OKC / CCKM / 802.11r

1. The client advertises Radio Measurement capabilities.
2. A capable client may request a Neighbor Report after association.
3. The AP or controller returns candidate BSS information, including BSSID, channel, and operating-class information.
4. The client can use that information to reduce the number of channels it needs to scan.

802.11k can reduce scan work, but it does not guarantee that scanning is eliminated, that discovery latency is near zero, or that the client will select a listed AP. The client may already possess cached scan information, undertake background scanning, or apply its own candidate filters. Neighbor Reports are candidate information, not a command.

• Solicited flow: a client can send a BTM Query, and the AP can respond with a BTM Request containing candidates.
• Unsolicited flow: the infrastructure can send a BTM Request based on a feature or policy, such as load management.
• Response: the client can accept or reject the request.
• Disassociation Imminent: the request can indicate that disassociation is planned after a timer, but the request itself is not an absolute command to associate with a specific target.

Additional 802.11v Functions

• Directed Multicast Service: allows a client to request delivery of selected multicast traffic as individually addressed frames, improving reliability and helping power-save operation. It should not be described as unconditional AP-wide multicast-to-unicast conversion.
• BSS Max Idle Period: tells the client how long the AP can maintain the association without receiving frames from it.
• Proxy ARP: can reduce unnecessary client wakeups, but on enterprise WLANs this behavior can also depend on controller and WLAN configuration beyond simply enabling 802.11v.

Protocol Comparison Matrix

What a Well-Optimized Enterprise Roam Looks Like

1. The client monitors its connection and decides that a transition is needed.
2. 802.11k information and the client’s own scan cache help it identify candidate APs.
3. An 802.11v BTM exchange may provide additional candidates or encourage a transition.
4. The client selects the target AP according to its own roaming algorithm.
5. 802.11r, OKC, or another mutually supported method reduces authentication delay.
6. The controller or AP updates client state and forwarding, and protected traffic resumes.

References

• Cisco Catalyst 9800 Series: A Primer on Enterprise WLAN Roaming
• Understand 802.11r/11k/11v Fast Roams on 9800 WLCs
• Cisco Catalyst 9800 Series Configuration Best Practices