Cisco 9800 Roam Type 802.11i Slow vs 802.11i Fast vs 802.11r
Hello, in this entry I initially though about explaining and comparing 802.11i roaming versus 802.1X with FT roaming, but then I though it may be more interesting to follow the process as seen from the Cisco 9800 WLC and DNAC, that is where I configured the packet captures, so I´ve been re-arranging the post several times. Also, we can check when the cisco 9800 WLC will show the roam type as 802.11i Slow, 802.11i Fast or 802.11r.
Capturing Packets with Cisco DNA Center (Catalyst Center)
This are the steps followed to get the captures on this post:
1.- From any tab on DNA Center, click the search button and type the MAC address you want to capture
2, 3.- Click on it and go to Client 360
4.- Once in Client 360, click on "Intelligent Capture"
5.- In the Intelligent Capture page for the selected device, click on "Run Packet Capture"
6.- A new tab will open, and there you can choose to do a Full Packet Capture or an Onboarding Packet Capture, program the capture or run now, and the duration of it
7.- If you have multiple Wireless Controller, you must verify if the correct one is choosen. In case it is not, select it, and scroll down to save your selection.
Enabling the Capture can take up to 9 minutes, so, bear this in mind if you are trying to coordinate the tests with a field engineer
Once the capture is enabled, you will be able to see the onboarding events followed by a "PCAP", and those are the downloadable files
WPA2 PSK Roaming --> 802.11i Slow Roam
Lets start following a barcode scanner roaming through 3 APs:
I was not actively troubleshooting any device and I just randomly picked up a device to follow, so although in the previous image I´m writing association as the second step of the first roam, it actually was already roaming, and as can be seen in the following packet capture, it was coming from AP-22:
That second step on the association to AP-039 would actually have been an association if the STA was not previously associated to the same ESSID.
On the capture we can see the process for a 802.11i association, where happens 3 steps:
1.- Open Authentication
2.- Association (or re-association)
3.- EAPoL or the 4 Way Handshake
On the 9800 we can wee the Mobility history as per below showing Roam Type "802.11i Slow":
Unfortunately, I didn´t made an screenshoot of the DNAC Client 360 Onboarding events for this capture, but it would show something very similar to this:
The STA needs to go through the full process of Authentication, Association (or re-association) and the 4-way Handshake every time.
WPA2 Enterprise Association
When using WPA2 Enterprise authentication, prior to the EAPoL 4 Way Handshake, we need to go through the 802.1X authentication as per below:
We can the see 802.1X process followed by the EAPoL in the packet capture below:
As you can see, for this client takes almost a whole second from the open authentication message 1 to the EAPoL M4
WPA2 Enterprise Roaming with FT
You have to be carefull with the configuration. In the 9800 WLC you have enable Fast Transition and FT+802.1X also. In case you don´t enable both like in the below:
The roam will not pass through the 802.1X authentication each time, but it will need to go through the EAPoL, and the results will be as follows, with the 9800 WLC showing the Roam Type as 802.11i Fast:
As soon as you enable both Fast Transition and FT+802.1X in your Cisco 9800 WLC, the roaming will work as intended in 802.11r. Here is what you would see in DNA Center:
When comparing both a 802.11i slow roam or a 802.11i fast roam, we can see around 30ms to 40ms, while a 802.1X + FT roam is normally below 9ms.
Wrapping up
So a initial authentication and roaming when using WPA2 Enterprise with FT enabled, should look like this:
And the mobility domain in the column MD Id (Mobility Domain ID) can be found in the 9800 WLC CLI:
And to finish up, lets see how the data correlates to the Cisco DNAC, the 9800 WLC and a packet capture:
I hope this helps ;)
Comentarios
Publicar un comentario