Professional Documents
Culture Documents
Cisco Systems® is pleased to introduce Cisco fast secure roaming with Cisco
IOS® Software release 12.2(11)JA for Cisco Aironet® 1200 and 1100 Series Access
Points and Cisco Aironet Client Adapter Installation Wizard version 1.1. Cisco fast
secure roaming, a component of Wireless Domain Services, provides significant
enhancements to Layer 2 (L2) roaming performance. With Cisco fast secure
roaming, wireless LAN (WLAN) clients can roam between Cisco Aironet access
points in fewer than 150ms. This application note examines all aspects of L2
roaming including: the necessity for fast secure roaming, L2 roaming components,
fast secure roaming latency improvements, and configuration considerations for
fast secure roaming.
Author
Bruce McMurdo, a Cisco enterprise solution design technical marketing engineer, is the
author of this application note.
Introduction
Wireless domain services (WDS) is introduced with the Cisco Structured Wireless-Aware
Network (SWAN). WDS is a collection of Cisco IOS Software features that enhance WLAN
client mobility and simplify WLAN deployment and management. These services, supported
today on access points and client devices, and on specific Cisco LAN switches and routers in
2004, include fast secure roaming and Institute of Electrical and Electronics Engineers
(IEEE) 802.1X local authentication.
Fast secure roaming is supported by Cisco Aironet 1200 and 1100 Series access points
in conjunction with Cisco or Cisco Compatible client devices. With fast secure roaming,
authenticated client devices can roam securely at L2 from one access point to another
without any perceptible delay during reassociation. Fast secure roaming supports
latency-sensitive applications such as wireless voice over IP (VoIP), enterprise resource
planning (ERP), or Citrix-based solutions (Figure 1). WDS provides fast, secure handoff
services to access points, without dropping connections, for fewer than 150ms roaming
within a subnet.
AP2 AP1
Note: Because the local WDS device handles roaming and reauthentication, the WAN link is not used
More information on Cisco SWAN is available from the references section at the end of this document and at
http://www.cisco.com/go/swan.
This document provides details on Cisco fast secure roaming protocol implemented in the following software
releases:
• Cisco IOS Software release 12.2(11)JA or greater for Cisco Aironet 1200 and 1100 Series access points
• Client Aironet Client Utility, firmware, and driver software releases included in Cisco Aironet Client Adaptor
Installation Wizard version 1.1 or greater
Cisco fast secure roaming enhancements will be included in Version 2 of the Cisco Compatible Extensions program,
which will be made available to third-party WLAN network interface card (NIC) vendors.
Table 1 and Table 2 summarize the client and infrastructure types that can and cannot utilize Cisco fast secure
roaming to roam between upstream access points.
Cisco Aironet 340, 350 wireless LAN client adapter cards Yes
Cisco Aironet 5 GHz, 54 Mbps wireless LAN client adapter cards Yes
Cisco Aironet 1200 and 1100 Series access points running Cisco IOS Yes
Software in repeater mode
Cisco Aironet 1200 and 1100 Series access points running Cisco IOS Yes
Software in access point mode
Cisco Aironet 350 Series access points running Cisco IOS Software in Yes
access point mode (when available)
Solution Overview
Networks are normally partitioned into discrete L2 domains corresponding to Internet Protocol (IP) subnets.
This partitioning and the difference between L2 and Layer 3 (L3) roaming are illustrated in Figure 2.
Layer 3
Distribution
Layer Switches
A L3 roam occurs when the client roams to an access point in a different subnet. Mobile IP capability is required to
provide seamless roaming across L3 subnet boundaries. Every L3 roam is preceded by a L2 link-layer roam. This
document examines L2 roaming in detail. L3 roaming will be addressed in a separate application note.
Wireless LANs provide the ability to connect to the network from virtually any location within the enterprise. The
desire to move from one location to another while maintaining an application session is a natural extension of this
extended network reach.
The trend toward wireless IP telephony, wireless laptops, and personal digital assistants (PDAs) will further
accelerate the desire for seamless network access for clients moving between locations. Wireless LAN benefits specific
to mobility include:
• Innovative application deployment—New and innovative applications such as actionable alerts, messaging, and
workflow applications that require always-on network connectivity, are now possible
• Improved efficiency and productivity—Continuous connectivity allows work to be performed any where, any
time without interruption
• Increased data accuracy—Data can be captured or updated immediately, from any location, which increases data
accuracy.
• Ubiquity—Users can remain online at virtually any location at home, at work or on the road
Cisco AVVID (Architecture for Voice, Video, and Integrated Data) provides comprehensive campus network
architecture including WLANs. Where possible, the existing Cisco AVVID L3 architecture should be maintained,
with wireless LANs deployed as an additional, dedicated, wireless subnet per wiring closet for WLAN overlays.
Detailed enterprise network design guidance is provided on the Cisco Solution Reference Network Design Guides
home page, available at http://www.cisco.com/go/srnd
Clients not compatible with Cisco Centralized Key Management (CCKM), can be migrated to CCKM by making
client use of CCKM optional.
Layer 2 Design
Due to access-point WDS processing and memory limitations, Cisco fast secure roaming currently supports a
maximum of 30 access points per L2 domain (subnet).
Caveats
Deploying WLANs as recommended in this document and in the Cisco AVVID Network Infrastructure Enterprise
Wireless LAN Design document may result in multiple L2 subnets on the same floor of a building. As recommended
in this document, mobile IP is required to roam seamlessly between these L2 subnets.
This section details WLAN client roaming and explains what happens when a WLAN client roams.
A L2 roam occurs when a WLAN client moves from one access point to another within the same subnet. If the client
moves to a new access point on a different IP subnet, L3 roaming occurs after the L2 roam has completed. Roaming
is always a client station decision. The client station is responsible for detecting, evaluating, and roaming to an
alternative access point. Figure 3 Sequence of Events for L2 Roam illustrates a L2 roam.
IAPP
Wired LAN Connecting APs
Inter Access
(Intra-Subnet Roaming)
Point Protocol
4
3
Access Access
Point A Point B
This guide focuses on events 1 and 2 in Figure 3. Events 3 and 4 are post-roam actions taken as part of the Cisco
Inter Access Point Protocol (IAPP) and are not discussed in this document.
• Event 1 in Figure 3 is discussed in the Roaming Events section of this document that describes the events that
cause a client to initiate the roam process.
• Event 2 in Figure 3 is discussed in the Fast Secure Roaming section where the process of discovering evaluating
and roaming to an alternative access point is reviewed.
This section reviews the events that cause a client to roam. The roaming process is described in the Fast Secure
Roaming section. Roaming is always initiated by the client, and is not defined by IEEE standards. For Cisco clients,
roaming is caused by one of the following events.
• Maximum data retry count is exceeded
• Missed too many beacons
• Datarate shift
• Initial startup
• Periodic client interval (if configured)
Figure 5 Max Data Retries, Beacon Period, and Data Rate Settings
Datarate Shift
Packets are normally transmitted at the access points’ default rate. The default rate is the highest rate set to the
“require” or “enable” setting on the access point. The configuration of data rate on an access point is shown in
Figure 5.
Every time a packet has to be retransmitted at a lower rate,1 a retransmit count is increased by three. For each packet
successfully transmitted at the default rate, the retransmit count is decreased by one, until it is zero. If the retransmit
count reaches 12, one of the following scenarios occurs:
• If the client has not attempted to roam in the last 30 seconds then the roam process as described in the fast secure
roaming event occurs.
• If the client has already attempted to roam in the last 30 seconds, the data rate for that client is set to the next
lower rate
A client transmitting at less than the default rate will increase the data rate back to the next-higher rate after a short
time interval if transmissions are successful.
1. A rate shift occurs when a frame is retransmitted three times and a request to send/clear to send (RTS/CTS) is used to send the last two
retransmissions.
Figure 6 Aironet Client Utility Configuration – Scan For A Better Access Point shows the default Aironet Client
Utility settings. With these settings, the client will scan for a better access point when both of the following conditions
have been met.
• The client has been associated to its current access point for at least 20 seconds. This restriction is to prevent a
client “flapping” or switching between access points too rapidly. Valid values are from 5 to 255 seconds
• The signal strength is less than 50 percent. Valid values range from zero to 75 percent.
The periodic scan is a roaming event that causes the occurrence of the roam process described in the Fast Secure
Roaming section.
Roam Process
The previous section described the five events that cause a client to decide that it needs to roam. This section discusses
what a client station does when it roams.
Once the scan is complete and the client has a list of responding access points, it selects the access point to compare
the others against. That access point is then referred to as the current access point. The current access point is
determined in the following manner:
• If this is the clients initial start-up
– Current access point = the first access point in the list
• If the client is roaming
– Current access point = the previously associated access point, if it responded to the probe request
• If the client is roaming and the previous access point did not respond to the probe request
– Current access point = the first access point in the list
The current access point is compared with each of the access points in the list of responding access points. To be
considered as a new current access point, each access point must meet all the criteria in Table 3.
Table 3 Access Point Conditions that Must Be Met for the Access Point to Be Considered a Roam Target
If the potential roam target access point is in repeater Not applicable—radio hop information is Cisco element
mode and is more radio hops from the backbone than in beacons. Client stations that do not have Cisco Aironet
the current access point, its signal strength must be at extension capability cannot read the Cisco beacon
least 20 percent greater than the current access point’s element.
signal strength
The transmitter load for the potential roam target access Not applicable—access point transmitter load
point can not be more than 10 percent greater than the information is Cisco element in beacons. Client stations
transmitter load of the current access point that do not have Cisco Aironet extension capability
cannot read the Cisco beacon element.
The client compares each access point that meets the base criteria listed in Table 3 with the current access point. If
an evaluated access point meets any of the criteria listed in Table 4, then the client selects it as the new current access
point, and compares the next access point in the list against this new current access point.
2. The client scans all 802.11 channels valid in the country in which the client is operating The Fast Secure Roaming section describes ways in which
the fast secure roaming channel scanning enhancements can reduce the number of channels that are scanned during a roam.
Client Station with Cisco Aironet Extensions Client Station without Cisco Aironet Extensions
Enabled (Access point must satisfy any condition) (Access point must satisfy all conditions)
At least four (or more) fewer clients associated to it than Not applicable—access point client association load
current access point information is Cisco element in beacons. Client stations
that do not have Cisco Aironet extension capability
cannot read the Cisco beacon element.
1. Transmitter load is an indication of how busy the access point radio is.
The Cisco fast secure roaming implementation in Cisco IOS Software release 12.2(11)JA is comprised of two
main enhancements.
• Improved 802.11 channel scanning during physical roaming
• Improved reauthentication using advanced key management
The improved 802.11 channel scanning during physical roaming enhancements speeds up all L2 roaming, regardless
of the security method used. The improved reauthentication, using advanced key management enhancements, speeds
up Cisco LEAP authentication to provide fast secure roaming.
Improved channel scanning is enabled by default on Cisco clients and access points and is not configurable. The
fast secure roaming enhancements to channel scanning require communication between the client and access point.
Improved channel scanning has the following software dependencies:
• Cisco IOS Software release 12.2(11)JA or greater
• Cisco Aironet Client Utility, firmware, and driver software, which is included in Cisco Aironet Client Adaptor
Installation Wizard version 1.1 or greater.
For each of the 802.11 channels valid in a specific regulatory domain, the client performed the following steps:
• Radio hardware physically moves to a specific WLAN channel
Access Points
Channel 1 Channel 6 Channel 11
Adjacent
Adjacent
Channels are
Channel is 1
1 and 11
Roaming Client
When a client needs to roam, it uses the adjacent access point list it received from its current access point to reduce
the number of channels it needs to scan. How the client uses the adjacent access point list depends upon how busy
the client is. There are three types of client roams:
• Normal Roam: The client has not sent or received a unicast packet in the last 500ms.
– The client does not use the adjacent access point list obtained from the previous access point. Instead it scans
all channels valid for the operating regulatory domain.
• Fast Roam: The client has sent or received a unicast packet in the last 500ms.3
– The client scans the channels on which it has been told there is an adjacent access point.
– If no new access points are found after scanning the adjacent access point list, the client reverts to scanning
all channels.
3. A typical IP telephony call generates a single packet in each direction every 20ms
Besides fast 802.11 channel scanning, the fast secure roaming feature provides a fast rekey capability for clients using
Cisco LEAP as their 802.1X authentication protocol.
Improved Cisco LEAP authentication introduces the new CCKM protocol that is a component of the Cisco Wireless
Security Suite.
In addition to network transit times, each of these roundtrip transactions requires time-consuming cryptographic
calculations, hence the total times quoted above.
Cisco fast secure roaming requires 802.1X authentication of access points and clients to a RADIUS server.
This authentication uses a dedicated RADIUS server, or the local authentication service running on a Cisco
Aironet access point.
Access Point
Client Access Point RADIUS
with WDS
The WDS function is written in Cisco IOS Software and initially runs on Cisco IOS Software on Cisco Aironet access
points only. In the future, WDS be available in Cisco router and switch infrastructure products.
At least one WDS is required per L2 domain. The CCKM architecture supports WDS redundancy via a MAC-layer
multicast primary WDS election process. If redundant WDS are configured, the WDS with the highest priority is
elected to be the primary WDS. If equal or no priorities are configured, a primary is dynamically determined.
Redundancy provides a cold backup. If the primary WDS fails, all authenticated clients continue to operate, until a
roaming event occurs, at which point the client completes a full initial authentication to the RADIUS server, via the
backup WDS. All access points in a L2 domain dynamically learn the address of the active WDS via an L2 multicast.
The address of the WDS is not configured in any access point.
The WDS supports a single L2 domain with up to 30 access points supported per L2 domain. The 30 access point
limit is not a physical limit, but is the maximum recommended by Cisco, and the maximum number supported by
Cisco Technical Assistance Center (TAC).
Comparing Cisco Fast Secure Roaming with 802.11i or WPA Security Protocols
While the CCKM protocol is very closely aligned to the 802.11i and WPA security specifications, it adds additional
steps to perform fast secure roaming. Currently, 802.11i and WPA have no equivalent fast secure roaming capability.
Cisco access points support both WPA and CCKM concurrently. However, only CCKM clients can perform fast
secure roaming. Figure 9 provides a high-level overview of the differences between 802.11i or WPA key management
schemes and CCKM.
WPA/802.11i CCKM
Authentication Authenticator/ WDS Authentication
Supplicant Authenticator Server Supplicant Supplicant Authenticator Server
Static Static
Password Cisco LEAP Password
Authentication
Infrastructure
Derive Derive
Authentication CTK CTK CTK
PMK NSK
4-way Handshake 4-way Handshake WLCCP
(nonces) (nonces) Encapsulation
Derive Derive Derive Derive
Key PTK PTK BTK/KRK PTK BTK BTK/KRK
Management
Derive
2-way Handshake 2-way Handshake PTK
Decrypt Decrypt
GTK GTK
Figure 9 outlines the key similarities and differences between 802.11i/WPA and CCKM. The additional steps
performed (during initial client authentication only) by CCKM are circled. CCKM derives different, additional keys
and introduces WDS between the access points and the RADIUS server.
Infrastructure Authentication
During the infrastructure authentication phase, all Cisco Aironet access points, including any running WDS,
authenticate using Cisco LEAP7 via the WDS, to a RADIUS server as shown in Figure 10.
Authenticator/ Authentication
Supplicant Authenticator Server
Layer 2
Layer 2
or Layer 3
Client Access Point Access Point RADIUS
with WDS
Static Static
Password Cisco LEAP Password
Authentication RADIUS
Derive Derive
CTK CTK CTK
All Cisco infrastructure devices in the L2 domain must authenticate to the WDS during the infrastructure
authentication phase as noted in Figure 10 above. This allows each access point to establish a shared key with the
WDS. This shared key is called the context transfer key (CTK) and is used to pass key material from the WDS to the
new access point during a fast secure roam.
Initial Authentication
When a WLAN client first associates to an access point in a new L2 domain, it performs a full 802.1X authentication,
via the WDS, to the RADIUS server. This initial authentication has the same latency characteristics as a non-CCKM
Cisco LEAP authentication.
Fast secure roaming occurs after the initial authentication, when the client moves to subsequent access points in the
same L2 domain.
The discovery phase is the same whether WPA/802.11i or CCKM is used (Figure 11) to authenticate the client.
Layer 2
Layer 2
or Layer 3
Client Access Point Access Point RADIUS
with WDS
Beacon/Probe response RSNIE
CCKM capability is communicated by a MAC organizationally unique identifier (OUI) value of 00:40:96 and a type
value of 0 in the Authenticated Key Management (AKM) suite selector of the RSNIE.
In CCKM, the 802.1X Cisco LEAP authenticator functionality is split between the access point to which the client
is associated and the WDS. The access point the client is authenticating to blocks all client data traffic until Cisco
LEAP authentication is complete–per the standard authentication process. Instead of communicating directly with
the RADIUS server to perform the Cisco LEAP authentication, the access point puts a wireless LAN context control
protocol (WLCCP) header on the packets, and sends them to the WDS. The WDS communicates with the RADIUS
server to complete the Cisco LEAP authentication.
A network session key (NSK) is mutually derived on the RADIUS server and the client following successful
authentication. (Figure 12).
Layer 2
Layer 2
or Layer 3
Client Access Point Access Point RADIUS
with WDS
EAP EAP
Credential Cisco LEAP Credential
Authentication WLCCP Encapsulation RADIUS
Derive
NSK
In the key management stage, the process for CCKM authentication differs significantly from WPA/802.11i
authentication. In this stage, an additional key—the base transient key (BTK)—is established on the WDS. In the
CCKM scheme, the BTK is used for fast secure roaming. For WPA/802.11i, the BTK does not exist and a full
reauthentication is required for roaming WPA/802.11i clients (Figure 13).
Layer 2
Layer 2
or Layer 3
Client Access Point Access Point RADIUS
with WDS
NSK
NSK NSK
4-way Handshake
(nonces) WLCCP Encapsulation
Derive Derive
BTK/KRK BTK/KRK
RN=1 ECTK (BTK RN=1)
BSSID
Derive Derive
PTK PTK
2-way Handshake
Receive Derive
GTK GTK
For CCKM clients, the RADIUS server forwards the NSK it derived from the Cisco LEAP authentication process to
the WDS (because from the RADIUS server’s viewpoint, the WDS was the 802.1X authenticator). The NSK is used
as the basis for deriving all subsequent keys for the lifetime of the client’s association with this extended basic service
set (EBSS)8, or until the RADIUS server’s rekey interval changes it.
The WDS and the client derive a BTK and a key request key (KRK) by combining the NSK with random numbers
(nonces) obtained via a process known as the four-way handshake. The four-way handshake appears to the client to
be between the client and the access point it is authenticating to, but the access point puts a WLCCP header on the
frames in the four-way handshake, and forwards them to the WDS.
After the four-way handshake is complete, WDS forwards the BTK, and a rekey number (RN) to the access point to
which the client is authenticating (since this is the initial authentication the WDS sets the RN to one). The access
point the client is authenticating to uses the BTK, RN, and basic service set identifier (BSSID)9 to derive a pairwise
transient key (PTK) which includes a shared session key for unicast traffic.
After the PTK has been successfully derived, the access point sends the group transient key (GTK) that is used for
multicast and broadcast traffic to the client, encrypted by an element of the PTK. The process of sending the GTK to
the client is called the two-way handshake. The BTK and KRK are used when the client roams to quickly establish a
new PTK.
Figure 14 Comparing a CCKM Roam Establishment with Industry Standard WPA/802.11i Key Management
WPA/802.11i CCKM
Authentication Authenticator/ WDS Authentication
Supplicant Authenticator Server Supplicant Supplicant Authenticator Server
WLCCP
Infrastructure
PMK
4-way Handshake Reassociate-
(nonces) Request
Derive Derive Derive
Key PTK PTK PTK BTK
Management
Derive
2-way Handshake PTK
Decrypt
GTK
Table 5 Comparing a CCKM Roam Establishment with Industry Standard Key Management
When a WPA/802.11i client roams, it completes a full When a CCKM client roams, it sends a reassociate
reauthentication, just as it did in the initial request to its new access point.
authentication. This includes: • The new access point forwards the reassociate request
• A full Cisco LEAP reauthentication with a central to the WDS
RADIUS server • The WDS sends the new access point the client’s BTK
• The complete four-way handshake to derive the PTK • The new access point and the client mutually derive a
• The complete two-way handshake to determine new PTK
the GTK • The GTK, encrypted by the PTK, is sent to the client
When a CCKM client roams, it sends a reassociation request message to the new access point. The reassociation
request includes:
Immediately after sending the reassociation request, the client is able to calculate its next PTK. It does this by
performing a cryptographic hash of the BTK, the RN, and the BSSID. Figure 15 shows the CCKM key management
phase in more detail.
The access point passes the reassociation request to the WDS by encapsulating it in the WLCCP protocol. The WDS
verifies the MIC. The WDS then encrypts the BTK and the RN with the CTK shared by the WDS and the new access
point, and passes the encrypted message to the new access point. The new access point then hashes the BTK, RN and
BSSID to calculate the same new PTK as the client. After the PTK has been mutually derived by the access point and
the client, the access point uses an element of the PTK to encrypt the GTK. The access point then passes the GTK to
the client.
Layer 2
Layer 2
or Layer 3
Client Access Point Access Point RADIUS
with WDS
BTK (KRK) BTK (KRK)
Note: CCKM roaming requires one roundtrip to a subnet-local WDS. An equivalent Cisco LEAP authentication
requires three roundtrips to a RADIUS server located on the network core.
This section provides design guidance for architecting and deploying L2 roaming considerations on a network.
Detailed campus wireless LAN design guidance is provided on the Cisco Solution Reference Network Design Guides
home page, available at http://www.cisco.com/go/srnd
Cisco provides comprehensive campus network architecture guidance with Cisco AVVID. For wireless LANs used in
existing networks as a wireless overlay or as freestanding all-wireless networks, the existing Cisco AVVID Layer 3
architecture should be maintained where possible, with the WLAN deployed as an additional, dedicated, wireless
subnet per wiring closet. Figure 16 shows a typical Cisco AVVID architecture to which a WLAN subnet has been
added to each access layer switch.
Layer 3
HSRP Active HSRP Active
VLAN 20, 41, 140 VLAN 40, 21, 120
In Figure 17, each access layer switch represents a separate wiring closet. A dedicated VLAN for each wireless LAN
access points is added to each switch. Access points are connected to a dedicated VLAN to minimize the broadcast
domain since WLANs are a shared half-duplex media and broadcasts have a bigger impact on access points than on
most devises connected to switch ports.
Some customers may decide to forgo a L3 architecture, and instead extend the L2 network to provide L2 mobility
across a larger section of the enterprise. For these customers, advanced spanning tree features such as Rapid Per
VLAN Spanning Tree Plus (Rapid PVST+) are useful.
Roaming
Cisco Aironet IAPP provides seamless mobility within a single subnet only. In the absence of mobile IP, when a
WLAN client moves to an access point on a different subnet, the IP address must be renewed. Windows 2000 and
Windows XP automatically renew IP addresses.
Renewing the IP address breaks application sessions that are using IP address. Some applications, such as e-mail, and
Web-based applications, may recover and continue to operate normally when their IP address is changed (either
automatically by Windows 2000 or XP, or manually if using a different operating system). Other applications such
as Telnet, File Transfer Protocol (FTP), and other connection-based applications will fail when their IP address is
changed and will need to be manually restarted. Mobile IP or proxy mobile IP (PMIP) is the solution for this
application problem as it maintains a constant IP address for host applications across L3 subnet boundaries.
This section illustrates the minimum steps required to configure CCKM fast secure roaming in a lab environment.
For more complete configuration details, please refer to the Cisco Aironet installation and configuration guides or
the Cisco Aironet release notes at:
http://www.cisco.com/en/US/products/hw/wireless/prod_category_positioning_paper0900aecd8009298f.html
Note: The graphical user interface (GUI) screen configuration will likely change with different Cisco IOS Software
releases. However, the Cisco IOS Software command line interface (CLI) configuration remains consistent across
releases.
All access points, including the WDS need to enable encryption. CCKM requires the selection of the cipher radio
button and one of the cipher modes in the Cisco Aironet access point set-up screen (Figure 17).
interface Dot11Radio0
encryption mode ciphers
ckip-cmic
All access points, including the WDS require enabling Cisco LEAP for a particular SSID (Figure 18).
In the Cisco Aironet access point set-up screen, perform the following steps:
1. Check the “Network EAP” check box (this is the authentication type used by Cisco LEAP)
2. Select the CCKM radio button and choose “Optional” or “Mandatory” from the drop-down menu.
(It is possible to choose “Optional” if a mix of CCKM and non-CCKM enabled devices are associating to the VLAN.
This option is useful when migrating clients to CCKM.)
Interface dot11 0
ssid <insert SSID>
authentication network-eap
eap_methods
authentication key-
management cckm
All access points in the subnet (including the access point running the WDS) authenticate to WDS using Cisco LEAP.
To perform this Cisco LEAP authentication, the access points must be statically configured with a Cisco LEAP user
name and password (and a matching user name and password must be configured on the RADIUS server).
Each access point in a subnet must authenticate to the WDS for that subnet. The username and password are
configured as shown in Figure 19. The configuration example uses Cisco as a password. Please ensure a more secure
password is chosen for your production deployments.
Cisco
Verify the WDS is operational and that the access points are correctly registered to the WDS.
The following commands verify the state of the WDS and the access point.
The most useful WDS monitoring command is the following command on the WDS:
Figure 21 shows a sample output from an access point running the WDS.
Testing Roaming
Configuring Client
There are no specific client configuration changes needed in order to use Cisco fast secure roaming. When testing
fast secure roaming, ensure the client has installed the Aironet Client Utility, firmware, and driver software releases
included in Cisco Aironet Client Adaptor Installation Wizard version 1.1 or greater.
Observe the message on the other access point that indicates the client has roamed, using CCKM fast roaming, as
shown in Figure 22.
Trouble Associating
If the client is having trouble associating to the access point, use the Aironet Client Utility debugging feature added
in Aironet Client Utility release 5.0 or greater to determine where it is failing (Figure 23).
Fast secure roaming requires upgrades of Cisco Aironet client adapter and access point software. Cisco IOS
Software release 12.2(11)JA (or greater) must be installed on Cisco Aironet 1200 and 1100 Series access points.
Cisco Aironet Client Adaptor Install Wizard version 1.1 (or greater) must be installed on applicable Cisco Aironet
WLAN client adapters.
Installing Cisco Aironet Client Adaptor Installation Wizard to Enable Fast Secure Roaming
To install the Cisco Aironet Client Adaptor Installation Wizard to enable fast secure roaming, follow the steps below
(Figure 25)
1. Ensure your 802.11a or 802.11b NIC is inserted or available on your laptop.
2. Downloaded the client installation program.
3. Double-click the “InstallWizard.exe” self-extracting install file.
4. Select the Unzip button from the WinZip pop-up application.
5. All required files will be automatically extracted and the install program shown in Figure 26 will be launched.
Figure 26 Selecting Cisco Aironet Client Adaptor Installation Wizard Installation Type
Loading the Fast Secure Roaming Cisco Aironet Access Point Software
This section describes how to use the Cisco IOS Software command line to upgrade Cisco Aironet 1200 and 1100
Series access points to Cisco IOS Software release 12.2(11)JA or later. The firmware can also be upgraded via the
access point GUI. The Cisco IOS Software command line is used here to highlight the difference between Cisco IOS
Software upgrades on Cisco Aironet access points and Cisco IOS Software upgrades Cisco routers and switches.
1. Telnet to the access point.
2. Use the following command to install the fast secure roaming software from a TFTP/FTP server. This example
uses a FTP server at IP address 10.50.1.50.
• Archive download-sw /overwrite /reload ftp://<FTP server IP address>/<image> (where image= the appropriate
.tar file for your access point.)
A software upgrade in progress is shown in Figure 28. Once the access point finishes loading, it will automatically
reboot with the new software.
References
Cisco Systems has more than 200 offices in the following countries and regions. Addresses, phone numbers, and fax numbers are listed on the
Cisco Web site at www.cisco.com/go/offices
Argentina • Australia • Austria • Belgium • Brazil • Bulgaria • Canada • Chile • China PRC • Colombia • Costa Rica • Croatia
Czech Republic • Denmark • Dubai, UAE • Finland • France • Germany • Greece • Hong Kong SAR • Hungary • India • Indonesia • Ireland
Israel • Italy • Japan • Korea • Luxembourg • Malaysia • Mexico • The Netherlands • New Zealand • Norway • Peru • Philippines • Poland
Portugal • Puerto Rico • Romania • Russia • Saudi Arabia • Scotland • Singapore • Slovakia • Slovenia • South Africa • Spain • Sweden
S w i t z e r l a n d • Ta i w a n • T h a i l a n d • Tu r k e y • U k r a i n e • U n i t e d K i n g d o m • U n i t e d S t a t e s • Ve n e z u e l a • Vi e t n a m • Z i m b a b w e
All contents are Copyright © 1992–2004 Cisco Systems, Inc. All rights reserved. Aironet, Catalyst, Cisco, Cisco IOS, Cisco Systems, and the Cisco Systems logo are registered trademarks of Cisco Systems, Inc. and/or its
affiliates in the U.S. and certain other countries.
All other trademarks mentioned in this document or Web site are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company.
(0304R) 204113_ETMG_LS_12.04