Accepted Solutions
-Is the Roaming decision is decided by the client ? or the WLC ?
It is purely client decision.
is that means everytime client roam either it's a layer 2 or L3 he will re authenticate and request an IP from the DHCP ? how the roaming is seamless then?
That is not normal, Did you see client change its IP address or just only DHCP request msg?
-The client is supposed to authenticate first when he try to join to the BSS , is the first authentication is where the AP will send the identity of the client to WLC then the WLC send it to the Radius server ? also when i was performing debugs i was seeing an association request comes 1st before authentication so what is the order of client joining ? will he associate 1st then authenticate or authenticate 1st ? lastly after authentication the client will go to DHCP process.
Initial association, you would see two authentication frames, those are "Open Authentication" frame prior to Assocation Request/Response. That is exchanged between STA & AP and those frame never go to RADIUS. Once associated depend on the security method configured, client has to prove its identity. That is called EAP exahnge process in 802.1X, that traffic has to go to RADIUS server.
Here is a 802.1X frame exchange during initial association & subsequent roaming (without any fast roaming or key caching)
-Is that normal that everytime the user roams to re authenticate ?
If no fast roaming mechanism (PMK caching, Opportunistic Key Caching or 802.11r/FT - Fast Trasnistion) implmented, then it is normal to fully authenciate. With those fast roaming mechanisms you can bypass full authentication in subsequent roaming within the same mobility group.
Here is what happen with PMK caching, only client roam back to previously associated AP can by pass full authentication.
Here is what happens with OKC
HTH
Rasika
*** Pls rate all useful responses ***
-Is the Roaming decision is decided by the client ? or the WLC ?
It is purely client decision.
is that means everytime client roam either it's a layer 2 or L3 he will re authenticate and request an IP from the DHCP ? how the roaming is seamless then?
That is not normal, Did you see client change its IP address or just only DHCP request msg?
-The client is supposed to authenticate first when he try to join to the BSS , is the first authentication is where the AP will send the identity of the client to WLC then the WLC send it to the Radius server ? also when i was performing debugs i was seeing an association request comes 1st before authentication so what is the order of client joining ? will he associate 1st then authenticate or authenticate 1st ? lastly after authentication the client will go to DHCP process.
Initial association, you would see two authentication frames, those are "Open Authentication" frame prior to Assocation Request/Response. That is exchanged between STA & AP and those frame never go to RADIUS. Once associated depend on the security method configured, client has to prove its identity. That is called EAP exahnge process in 802.1X, that traffic has to go to RADIUS server.
Here is a 802.1X frame exchange during initial association & subsequent roaming (without any fast roaming or key caching)
-Is that normal that everytime the user roams to re authenticate ?
If no fast roaming mechanism (PMK caching, Opportunistic Key Caching or 802.11r/FT - Fast Trasnistion) implmented, then it is normal to fully authenciate. With those fast roaming mechanisms you can bypass full authentication in subsequent roaming within the same mobility group.
Here is what happen with PMK caching, only client roam back to previously associated AP can by pass full authentication.
Here is what happens with OKC
HTH
Rasika
*** Pls rate all useful responses ***
