Roaming between different mobility groups

[Mitrixsen]

Hello, everyone.

I understand that seamless roaming involves two parts:
- Maintaining the client's IP address so they don't have to request DHCP again
- Caching of credentials and roaming enhancements (such as 802.11r, CCKM, etc) so the client doesn't have to perform a full re-authentication

I also understand that roaming within a mobility group ensures both point 1 and point 2 if implemented correctly. Roaming between different mobility groups is also possible if the WLCs see eachother in their mobility list/domain. 

The controllers in the ABC mobility group share access point and client information with each other. The controllers in the ABC mobility group do not share the access point or client information with the XYZ controllers, which are in a different mobility group, unless each mobility group member is configured with mobility list entries for the other mobility group members.

Here is something that I am unsure of:

WLCs supports up to 72 controllers in the mobility list of a controller and seamless roam across multiple mobility groups. Through seamless roaming, the client maintains its IP address across all mobility groups. However, Cisco Centralized Key Management (CCKM) and Proactive Key Caching (PKC) are supported only for intra-mobility-group roaming.

Does this mean that roaming between mobility groups (but within a mobility list/domain) preserves the IP address but not the roaming credentials?

So if a roam occurs within a mobility group - IP is preserved together with whatever roaming enhancements we have implemented (CCKM, 802.11r).

If a roam occurs between two different mobility groups but within the same mobility list - IP is preserved but roaming enhancements aren't, so the client has to fully re-authenticate

If a roam occurs between two different mobility domains - the client obtains a new IP and has to fully re-authenticate?

Could someone please verify my understanding here?

Thank you!
David

[M02@rt37 · Accepted solution]

Hello David,

Roaming within the same wlc mobility group allow clients to maintain their IP ADD and benefit from fast roaming enhancements like CCKM, PKC, and 802.11r ; that's ensure seamless transitions.

On the other hand, roaming between diferent mobility group that are part of the same mobility list, clients still retain their IP address, but fast roaming features are not supported __ this time, full reAUTH is required...

Also, raming between mobility domain result in the client lose its IP and undergoing full DHCP and Auth., making the roam non-seamless !

[balaji.bandi · Accepted solution]

So if a roam occurs within a mobility group - IP is preserved together with whatever roaming enhancements we have implemented (CCKM, 802.11r).

this is expected to work as expected.

If a roam occurs between two different mobility groups but within the same mobility list - IP is preserved but roaming enhancements aren't, so the client has to fully re-authenticate

sure this required new session.

If a roam occurs between two different mobility domains - the client obtains a new IP and has to fully re-authenticate?

since its got new IP then session re-authenticate.

check some guidelines and improvements done in cat 9800 WLC.

https://www.cisco.com/c/en/us/products/collateral/wireless/catalyst-9800-series-wireless-controllers/cat9800-ser-primer-enterprise-wlan-guide.html

https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2024/pdf/BRKEWN-2339.pdf