Wireless/Redundant Edge Services xl Module Management and Configuration Guide WS.02.xx and greater

9-4
Fast Layer 2 Roaming and Layer 3 Mobility
Overview
The 802.11i standard (on which WPA is modeled) includes a section on pre-
authentication, a mechanism that speeds up Layer 2 roaming. A station can
associate to only one RP and Wireless Edge Services xl Module at a time.
However, the station can detect beacons from other RPs—including RPs
connected to other modules. A station using pre-authentication listens for
such beacons and pre-authenticates to other modules while it is still con-
nected to its original module.
Because the station is still connected to its original module, its pre-authenti-
cation messages must pass through the original module, onto the wired
network, and finally to the second module. These pre-authentication mes-
sages are the Extensible Authentication Protocol (EAP) messages required by
802.1X, and the station addresses them to the Basic Service Set Identifier
(BSSID) of the WLAN on the RP to which it is pre-authenticating.
Enabling pre-authentication on a Wireless Edge Services xl Module lets the
module listen for EAP messages that arrive on its internal uplink port and
respond to those destined to its RPs. The station authenticates to the second
module, and the module and the station set in place all the encryption keys
necessary for WPA, before the station ever roams. Thus, when the station does
roam, it does so very quickly (in less than 50 milliseconds).
Note The EAP pre-authentication messages do not cross VLAN borders. Therefore,
the two Wireless Edge Services xl Modules must assign the WLAN to the same
subnetwork (VLAN). This requirements means that Layer 3 mobility,
described in the next section, is seamless, but not fast.
Layer 2 Roaming on a Web-Auth WLAN Between
Different Wireless Edge Services xl Modules
Like 802.1X authentication, Web-Auth can complicate a roam between RPs
adopted by different Wireless Edge Services xl Modules. The new module
considers the roaming station a new, unauthenticated station, so it redirects
the station’s Web browser to the login page. Because the user must reauthen-
ticate, the roam is not seamless.
The best solution for roaming with Web-Auth is to have a single Wireless Edge
Services xl Module adopt all RPs that support the WLAN in question. The RPs
can range over an extensive area: Layer 3 adoption enables them to reach the
module across subnetwork boundaries.
If necessary, however, you can enable seamless Layer 2 roaming between
different modules, even on a WLAN that enforces for Web-Auth. Place all
Wireless Edge Services xl Modules that support the Web-Auth WLAN in the