Wireless/Redundant Edge Services xl Module Management and Configuration Guide WS.02.xx and greater

9-3
Fast Layer 2 Roaming and Layer 3 Mobility
Overview
Fast Layer 2 Roaming for WPA/WPA2 with 802.1X
WPA’s Temporal Key Integrity Protocol (TKIP) (and WPA2’s Counter Mode
CBC-MAC Protocol [CCMP]) derive encryption keys from a unique Pairwise
Master Key (PMK) for each association with a wireless station. Because the
PMK is necessary for the station and the Wireless Edge Services xl Module to
communicate, the module must ensure that it maintains the key for a roaming
station. The following mechanisms help it to do so:
■ Pairwise Master Key (PMK) caching—Enables fast roaming back to
an RP adopted by the Wireless Edge Services xl Module.
PMK caching allows the module to store a station’s PMK after the station
disassociates with one of the module’s RPs. Caching ensures that the key
is still in place if the station again associates with an RP adopted by the
module.
■ Opportunistic Key caching—Facilitates fast roaming to a new RP on
the local Wireless Edge Services xl Module.
Opportunistic key caching enables the module to push PMKs down to all
adopted RPs, so that the correct key is in place if a station roams to a
new RP.
These mechanisms are enabled by default, although you can disable them on
particular WLANs. A third mechanism, pre-authentication, completes the
requirements for fast roaming between RPs adopted by different Wireless
Edge Services xl Modules.
Note Using pre-authentication to enable fast roaming also applies to roaming
between an AP and a Wireless Edge Services xl Module.
Pre-authentication
Roaming becomes more complicated when a station roams from an RP
adopted by one module to an RP adopted by another module.
The complication arises from the authentication enforced in the WLAN.
Because the station has not authenticated to the second module, the second
module does not know whether the station is allowed to connect. 802.1X
authentication, in particular, slows down a roam because it requires several
exchanges of messages, usually to a network RADIUS server.
In addition, as noted above, WPA uses 802.1X authentication to create unique
encryption keys for each station. The second module does not have the correct
key for the station until the station authenticates to it.