User Manual

5-26
Cisco Aironet Wireless LAN Client Adapters Installation and Configuration Guide for Windows
OL-1394-06
Chapter 5 Configuring the Client Adapter
Setting Network Security Parameters
Reporting Access Points that Fail LEAP Authentication
Client adapter firmware version 5.02.20 or greater and the following access point firmware versions
support a new feature that is designed to detect access points that fail LEAP authentication:
• 12.00T or greater (340, 350, and 1200 series access points)
• 12.2(4)JA or greater (1100 series access points)
An access point running one of these firmware versions records a message in the system log when a
client running firmware version 5.02.20 or greater discovers and reports another access point in the
wireless network that has failed LEAP authentication.
The process takes place as follows:
1. A client with a LEAP profile attempts to associate to access point A.
2. Access point A does not handle LEAP authentication successfully, perhaps because the access point
does not understand LEAP or cannot communicate to a trusted LEAP authentication server.
3. The client records the MAC address for access point A and the reason why the association failed.
4. The client associates successfully to access point B.
5. The client sends the MAC address of access point A and the reason code for the failure to access
point B.
6. Access point B logs the failure in the system log.
Note This feature does not need to be enabled on the client adapter or access point; it is supported
automatically in the firmware of both devices. However, both the client and access point must use
these firmware versions or greater.
Fast Secure Roaming
Some applications that run on a client device may require fast roaming between access points. Voice
applications, for example, require seamless roaming to prevent delays and gaps in conversation. Support
for fast secure roaming is now available for LEAP-enabled clients in client adapter firmware version
5.20.17.
During normal operation, LEAP-enabled clients mutually authenticate with a new access point by
performing a complete LEAP authentication, including communication with the main RADIUS server.
However, when you configure your wireless LAN for fast secure roaming, LEAP-enabled clients
securely roam from one access point to another without the need to reauthenticate with the RADIUS
server. Using Cisco Centralized Key Management (CCKM), an access point that is configured for
wireless domain services (WDS) uses a fast rekeying technique that enables client devices to roam from
one access point to another in under 150 milliseconds (ms). Fast secure roaming ensures that there is no
perceptible delay in time-sensitive applications such as wireless Voice over IP (VoIP), enterprise
resource planning (ERP), or Citrix-based solutions.
This feature does not need to be enabled on the client adapter; it is supported automatically in client
adapter firmware version 5.20.17 or greater (which is included in Install Wizard version 1.1 or greater).
However, it must be enabled on the access point.
Note Access point firmware version 12.2(11)JA or greater is required to enable fast roaming. Refer to the
documentation for your access point for instructions on enabling this feature.