Multiple Anchor to multiple Foreign(Mobility Anchored SSID Roaming)

[MBasal111]

Hello Team,

We have a design of Multiple anchors to multiple foreign, 

Foreign and anchor WLCs are in different Mobility groups.

All foreign WLCs are in the same Mobility groups. 

Anchors-WLC1 and Anchors-WLC2 are in the same Mobility groups.

Anchors-WLC3 and Anchors-WLC4 are in the same Mobility groups. 

There is a mobility tunnel between Foreign -WLC1 and Foreign -WLC2.

Foreign -WLC1 builds mobility for both Anchor-WLC1 and Anchor-WLC2.

Foreign -WLC2 build mobility for both Anchor-WLC 3 and Anchor-WLC 4.

 Foreign-WLC1 5508 8.0.152

 Foreign-WLC2 5520 8.10.185

Anchor-WLC 1 5508 8.5.176

Anchor-WLC 2 5508 8.5.176

Anchor-WLC 3 9K 17.12.4

Anchor-WLC 4 9K 17.12.4

Same SSID created in all anchors with the same interface group, returned by ISE, security is EAP-TLS, DHCP required Disabled:

Foreign -WLC1 anchored to Anchor-WLC1 && Anchor-WLC2

Foreign -WLC2 anchored to Anchor-WLC3 && Anchor-WLC4

We need to know how the roaming is work while the client is roam between Foreign -WLC1 to Foreign -WLC2, while each foreign mapped to different anchor but the same interface group mapped. as we have an issue Entry not removed in Anchor-WLC1 && Anchor-WLC2  while the client roam between Foreign -WLC1 to Foreign -WLC2.

[Rich R]

Sorry you lost me in all your explanations!

What I can say though is that this is thoroughly documented so best to read through the guides carefully:
https://www.cisco.com/c/en/us/td/docs/wireless/controller/9800/config-guide/ConfiguringIRCM/b-configuring-inter-release-controller-mobility-in-wireless-deployments-supporting-aireos-and-catalyst-9800-controllers/m-overview-of-ircm.html
https://www.cisco.com/c/en/us/td/docs/wireless/controller/technotes/8-8/b_c9800_wireless_controller-aireos_ircm_dg.html
That should answer most of your questions. And if you search you'll find plenty more examples and videos.

And pay close attention to the TAC recommended versions of code (link below) because some of your code versions are out of date!

[Scott Fella]

What will happen in your scenario is, since anchor sessions are not shared, it will be a new authentication because the anchor controllers are not sharing this information.  What will work is multiple foreign controller tied to a single anchor controller.