5508 to 9800 roaming issue: profile mismatch

[Chris Donkelaar]

We are migrating a site from 5508 WLCs with 3502 APs towards a 9800 WLC with 9120 APs. To support a rip and replace scenario we loaded the 5508 with the 8.5MR5ircm image so roaming between the old and new network would be possible. DHCP has been setup with option 60 to send 9120s towards the new controllers, while keeping the 3500s on the old controllers. 

Now we have 2 SSID's, 1 open for general use, and 1 corporate SSID with  dot1x (EAP-TLS), and the situation is as follows:

•  The open SSID users stay on the same vlan while roaming from the old to the new controller and vice versa. The first test failed with the message on the 9800: Handoff Deny: Profile Mismatch. It turned out that FT was enabled on the new controller while disabled on the old. After we disabled it, roaming worked perfectly well.
• The corporate SSID is set up on the old controller with an interface group, where AP groups are set up with the correct vlan interface per campus building and floor. On the new controllers we are migrating to a new IP plan, with corresponding vlans. Now the roaming is working only 1 way, from the old controller to the new. In the client monitoring view on the 980 you see these client with an IP address from the old controller and marked as foreign, which is correct. Only, when we are roaming from the new 9800 controller to the old 5508 controller, we get again the mobility message: Handoff Deny: Profile Mismatch. All settings have been double checked, naming, security, FT, radius servers (even the order is the same as with the old controllers), and are set up equally. But it only works from 5508 to 9800, and not the other way around. Is this because of the interface group on the main WLAN profile of the 5508? Or do we have to look into other directions?

Best regards,

Chris Donkelaar

[patoberli]

The mobility-group is correctly up between the two controllers?
There is also a possibility you are hitting a bug though.

[Chris Donkelaar]

Yes, it is. As stated is the roaming working on the open SSID both ways (and the debug messages do confirm this with a correct mobility handoff). For the corporate SSID it's only working from old to new, not from new to old. 

Best regards,

Chris

[patoberli]

Can you run a "debug client <clientmacaddress>" on both WLC and then roam from the new to the old?
Please attach those two files here.

[Chris Donkelaar]

Hereby the already saved debugs (changed a few privacy things to a suitable name). Not entirely the same timeframe, but with both sides the same outcome.

Gr

Chris

[patoberli]

The working open SSID doesn't need much of roaming, as no encryption keys are being exchanged, unlike with the encrypted one.
Do you have DHCP required enabled in the advanced options of the SSID on the old WLC? I had made very bad experiences with it in the past and controller roaming. In the end I had to disable it.

[Chris Donkelaar]

It tend out to be a naming mismatch between the profile name on the WLAN ID in the 5508 and the WLAN Profile Name on the 9800. So, make sure they are the same on both sides. 

In the 9800 config guide this is now described as follows:

• In mixed deployments, the WLAN profile name and the policy profile name are the same.

This was not the same sentence as was there when I had this issue, but now it is stated more clear.