Windows machines and 802.11r

[trondaker]

Hi,

Might not be the optimal place to ask about a Microsoft-issue, but we have many enterprise laptops running the latest windows 10 with intel wifi-cards that support 802.11r. The SSID is running FT adaptive, and iOS-devices are successfully connected and using FT/802.11r. However, the devices that we need better roaming for, the laptops running win 10 - are not. Does anyone have any experience getting win 10 working with 802.11r? Is this some weird GPO-thing that has to be enabled? The SSID is obviously working fine with 802.11r for iOS.

[Leo Laohoo]

---

@trondaker wrote:

with intel wifi-cards

---

What is the exact model of the Intel cards? 
What is the exact firmware the Intel cards are running on?

[trondaker]

Intel Wifi 6 AX200 160 MHz (version 22.60.0.6). We have different Windows 10 platforms, but i cant see any of them working with FT, so was curious if this was related to some setting in the nic-driver or registry.

[Leo Laohoo]

Intel wireless NIC have a setting called Roaming Aggressiveness.  Default settings is a "2" or (Medium-Low) and the lower the number the worst.

We set our fleet to "3".  

[trondaker]

But that shouldnt matter to how the client connects right? Other clients that connect using FT is marked as "FT-802.1x".

[Arshad Safrulla]

Kindly share the WLAN configuration where the issues were noticed. You may sanitize the outputs to change sensitive info. Also from WLC side it is recommended that you have Over the air only as this has wider support, if your AP's are Flex then Over the DS should be no go.

For the reference of anyone checking the thread, below is a list of Intel WLAN cards which supports 802.11k,v & r.

https://www.intel.com/content/www/us/en/support/articles/000021562/wireless/intel-wireless-products.html

Remember to run the latest drivers always for best results.

[trondaker]

The only thing i have enabled is "Fast Transition: Adaptive", and "Over the DS: disabled". All clients have hardware compatible with the list above, so i just cant quite get why they dont connect with 802.11r enabled.

[Arshad Safrulla · Accepted solution]

I would say just enable FT for the WLAN. This will allow non-FT devices to connect without FT and FT compatible devices to use FT. Setting it to adaptive is always creates problems. Adaptive was built for networks where FT is not enabled and it is readable by only certain devices

You can refer the below thread which is super helpful

https://community.cisco.com/t5/wireless/802-11r-can-same-wlan-be-used-for-802-11r-capable-and-non/td-p/3214096

[trondaker]

Great info, i read the doc as FT Adaptive is good for mixed networks where both FT-able devices and non-capable can co-exist - i now see that this is basically a hack for iOS-devices. Thanks!

[Scott Fella]

It’s not a hack. Manufacturer decide on what they will implement from the standard. That is why some devices work on. Strain configuration’s and others don’t. They don’t implement the standard all the same. 

[Scott Fella]

When it comes down to some of these issues with drivers, always try to use the drives from the laptop manufacturer. Microsoft only bundles the drivers for the Surface laptops.  Also with Windows, 802.11r is only supported on 802.1x not PSK or Open SSID’s. 
Also search the internet for the NIC model for a specific laptop to see if others are having issue also. 
Example:

https://community.intel.com/t5/Wireless/Intel-Wifi-6-ax200-ax201-keeps-disconnecting-from-my-WiFi/m-p/632805

[trondaker]

Indeed i have googled hard But still cant quite figure out whats the problem here. The SSID is 802.1x-enabled, ISE running the authentications.

[Leo Laohoo]

Is the SSID configured with WPA2 or WPA3 with PMF enabled?

[Yauzer · Accepted solution]

Just because the Intel Wi-Fi module/adapter supports FT-802.11R doesn't mean it is enabled.  Windows OS Endpoints in particular, if managed via Intune or alike, will need a policy to be pushed out to enable it.  The "netsh wlan sh all" command will show whether the Wi-Fi adapter/module support FT, but I haven't found a command to verify if it is enabled.

[trondaker]

Took a while, but as Yazuer writes - the Windows-machines didnt implement it correctly/fully yet, and thus wouldnt connect with it. With newer drivers they work fine.