Login
- Table of Contents
-
- 22-WLAN Configuration Guide
- 00-Preface
- 01-WIPS configuration
- 02-WLAN roaming configuration
- 03-WLAN security configuration
- 04-WLAN load balancing configuration
- 05-Channel scanning configuration
- 06-WLAN radio resource measurement configuration
- 07-WLAN probe configuration
- 08-Band navigation configuration
- 09-Spectrum management configuration
- 10-AP management configuration
- 11-Radio management configuration
- 12-WLAN access configuration
- 13-WLAN authentication configuration
- 14-WLAN QoS configuration
- 15-WLAN IP snooping configuration
- 16-WLAN high availability configuration
- Related Documents
-
| Title | Size | Download |
|---|---|---|
| 02-WLAN roaming configuration | 455.59 KB |
Setting the roaming entry aging time
Display and maintenance commands for WLAN roaming
802.1X fast roaming mechanism
Restrictions and guidelines: MAC fast forwarding
Enabling fast-connect for MAC authenticated intra-AC roaming clients
Restrictions and guidelines: 802.11r configuration
Restrictions and guidelines: 802.11v configuration
Configuring BTM disassociation
Configuring virtual BSS roaming
Restrictions and guidelines: Cooperative roaming configuration
Configuring client anti-sticky
Enabling an AP to obtain BSS candidate information
Enabling data transmission holding during roaming
Display and maintenance commands for cooperative roaming
Restrictions and guidelines: Mobility group configuration
Mobility group tasks at a glance
Setting an authentication mode for IADTP control messages
Specifying an IP address type for IADTP tunnels
Specifying the source IP address for establishing IADTP tunnels
Setting the DSCP value for IADTP keepalive packets
Adding a mobility group member
Manually adding a mobility group member
Enabling automatic group member discovery
Specifying the mobility group member role of a device
Enabling tunnel isolation for mobility groups
Enabling SNMP notifications for WLAN roaming
Display and maintenance commands for mobility groups
Configuring WLAN roaming
The following compatibility matrix shows the support of hardware platforms for WLAN roaming:
|
Series |
Models |
WLAN roaming compatibility |
|
F5000系列 |
F5000-AI-160-G、F5000-AI-130-G、F5000-AI-120-G、F5000-AI-110-G、F5000-AI-55-G、F5000-AI-25-G、F5000-AI-15-G、F5000-CN160-G、F5000-E-G、F5000-E-G2、F5000-S-G2、F5000-M-G2、F5000-A-G2、F5000-CN160、F5000-CN-G55、F5080、F5030 |
No |
|
F5000-AI160 |
Yes |
|
|
F1000系列 |
F1000-AK9130、F1000-AI-35、F1000-AI-25、F1000-AI-10、F1000-AI-03-E、F1000-AI-90-G、F1000-AI-80-G、F1000-AI-75-G、F1000-AI-65-G、F1000-AI-55-G、F1000-AI-35-G、F1000-AI-25-G、F1000-AI-05-G、F1000-AI-03-G、F1000-AI-05-GS、F1000-AK1380-G、F1000-AK1300-G、F1000-AK1220-G、F1000-AK1180-G、F1000-AK1080-G、F1000-AK1050-G |
No |
|
F1000-AI-90、F1000-AI-60、F1000-AI-55、F1000-AI-15 |
Yes |
About WLAN roaming
WLAN roaming enables clients to seamlessly roam among BSSs in an ESS while retaining their IP address and authorization information during the roaming process.
WLAN roaming mechanism
As shown in Intra-AC roaming, the client roams from AP 1 to AP 2 as follows:
1. The client comes online from AP 1, and the AC creates a roaming entry for the client.
The entry records the initial SSID at association, PMKID, authentication method, security mode, and roaming VLAN.
2. The client roams to AP 2. The AC examines the roaming entry.
3. The client performs reauthentication and then comes online from AP 2.
Figure 1 WLAN roaming mechanism
Layer 3 roaming
As shown in Figure 2, the client can roam between APs in different VLANs without special configuration. For the roaming procedure, see "WLAN roaming mechanism."
Setting the roaming entry aging time
About this task
Client roaming entries record client PMKs, VLAN, and other authorization information. If a disconnected client connects to an AP before its roaming entry expires, the client can inherit authorization recorded in the entry and achieve fast roaming.
If a disconnected client cannot come online before its entry expires, the system deletes the entry.
Restrictions and guidelines
Setting the roaming entry aging time to 0 allows the system to delete the roaming entry of a client once the client goes offline. Fast roaming cannot be performed.
The aging time is applicable only to intra-AC roaming entries. It does not take effect on inter-AC roaming entries.
Procedure
1. Enter system view.
system-view
2. Enter service template view.
wlan service-template service-template-name
3. Set the roaming entry aging time.
client cache aging-time aging-time
By default, the roaming entry aging time is 180 seconds.
Display and maintenance commands for WLAN roaming
Execute display commands in any view.
|
Task |
Command |
|
Display roam-track information for a client. |
display wlan mobility roam-track mac-address mac-address |
Configuring enhanced roaming
About enhanced roaming
WLAN supports the following enhanced roaming technologies:
· 802.1X fast roaming—Allows users to come online from a new AP or radio without being reauthenticated. It is applicable only when RSN+802.1X authentication is used.
· MAC fast roaming—Allows users to come online from a new AP or radio without being reauthenticated. It is applicable only when MAC authentication is used.
· 802.11r—Shortens roaming latency to reduce client disconnection rate and improve the service quality.
· 802.11v—Enables 802.11v clients to connect to a more suitable AP, enhancing the roaming service quality for 802.11v wireless clients.
· Virtual BSS roaming—Enables the AC to monitor client signal strength in real time and guide clients to roam to the optimal APs in the same ESS seamlessly.
· Cooperative roaming—Provides seamless roaming of wireless clients in an ESS by using IEEE802.11k, IEEE802.11r, and IEEE802.11v.
802.1X fast roaming
802.1X fast roaming mechanism
Intra-AC roaming
As shown in Figure 3, 802.1X fast intra-AC roaming operates as follows:
1. The client comes online from AP 1 after passing RSN+802.1X authentication. AP 1 creates a roaming entry for the client.
For more information about 802.1X authentication, see "Configuring WLAN security."
2. The client roams to AP 2. The AP examines the roaming entry for the client and triggers 802.1X fast forwarding if the client carries the same PMKID as the AP.
The system uses the cached PMK to perform key negotiation and the client can associate with AP 2 without reauthentication.
|
|
NOTE: The system supports using the following methods to cache PMKID: · Sticky Key Caching (SKC)—Directly caches the PMKIDs generated during 802.1X authentication of clients. · Opportunistic Key Caching (OKC)—Uses the currently associated BSSID, client MAC address, and cached PMK to generate a PMKID. Both methods support 802.1X fast roaming without manual intervention. |
Inter-AC roaming
As shown in Figure 4, 802.1X fast inter-AC roaming operates as follows:
1. AC 1 and AC 2 are in a mobility group. The client comes online from AC 1 after passing RSN+802.1X authentication. AC 1 creates a roaming entry for the client.
2. AC 1 sends the roaming entry over the IADTP tunnel to AC 2.
3. The client roams to AC 2. AC 2 examines the roaming entry for the client and triggers 802.1X fast forwarding if the client carries the same PMKID as the AC.
The system uses the cached PMK to perform key negotiation and the client can associate with AC 2 without reauthentication.
Figure 4 802.1X fast inter-AC roaming
MAC fast roaming
Intra-AC roaming
Intra-AC roaming enables clients to roam among APs that are managed by the same AC.
As shown in Figure 5, intra-AC roaming uses the following procedure:
1. The client comes online from AP 1, and the AC creates a roaming entry for the client. For more information about MAC authentication, see "Configuring WLAN authentication."
2. The client roams to AP 2. The AC examines the roaming entry for the client and determines whether to perform fast roaming.
If the client uses RSN + 802.1X authentication and carries the same PMKID as the AC, fast roaming is used, and the client can associate with AP 2 without reauthentication. If it is not, the client must be reauthenticated before associating with AP 2.
Restrictions and guidelines: MAC fast forwarding
802.1X fast roaming supports only roaming between APs managed by the same AC.
Enabling fast-connect for MAC authenticated intra-AC roaming clients
About this task
This feature allows a MAC authentication roaming client that has been authenticated once on the AC to come online from any APs attached to the AC without re-authentication.
Restrictions and guidelines
This feature applies only to MAC authentication wireless clients whose authentication location and association location are both on the AC.
This feature affects the displayed roaming state of inter-AC roaming clients that use MAC authentication and requires special configuration for them.
· If a client has roamed between ACs, its roaming state is N/A in the output from the display wlan client verbose command.
· If the inter-AC roaming clients belong to different VLANs, you must make sure the upstream ports of all the ACs in the same roaming group permit traffic from these VLANs to pass through.
Prerequisites
Before you can configure this feature in a service template, you must disable that service template.
Procedure
1. Enter system view.
system-view
2. Enter service template view.
wlan service-template service-template-name
3. Enable fast-connect for MAC authenticated intra-AC roaming clients.
mac-authentication fast-connect enable
By default, fast-connect is enabled for MAC authenticated intra-AC roaming clients.
802.11r
About 802.11r
802.11r fast BSS transition (FT) minimizes the delay when a client roams from a BSS to another BSS within the same ESS. During 802.11r FT, a client needs to exchange messages with the target AP.
FT provides the following message exchanging methods:
· Over-the-air—The client communicates directly with the target AP for pre-roaming authentication. This method is applicable to scenarios with high requirements on roaming compatibility.
· Over-the-DS—The client communicates with the target AP through the current AP for pre-roaming authentication. This method is applicable to scenarios with high requirements on roaming performance.
Intra-AC roaming through over-the-air FT
As shown in Figure 6, the client is associated with AP 1. Intra-AC roaming through over-the-air FT uses the following process:
1. The client sends an FT authentication request to AP 2.
2. AP 2 sends an FT authentication response to the client.
3. The client sends a reassociation request to AP 2.
4. AP 2 sends a reassociation response to the client.
5. The client roams to AP 2.
Intra-AC roaming through over-the-DS FT
As shown in Figure 7, the client is associated with AP 1. Intra-AC roaming through over-the-DS FT uses the following process:
1. After the client comes online, the AC creates a roaming entry and saves it for the client.
2. The client sends an FT authentication request to AP 1.
3. AP 1 sends an FT authentication response to the client.
4. The client sends a reassociation request to AP 2.
5. AP 2 sends a reassociation response to the client.
6. The client roams to AP 2.
Figure 7 Intra-AC roaming through over-the-DS FT
Restrictions and guidelines: 802.11r configuration
When you configure 802.11r, follow these restrictions and guidelines:
· To enable a client that does not support FT to access the WLAN, create two service templates using the same SSID: one enabled with FT and the other not.
· To prevent a client from coming online every time the periodic re-authentication timer expires, do not enable FT and 802.1X periodic re-authentication for the same service template. For more information about 802.1X periodic re-authentication, see "Configuring WLAN security."
· PTK updates are not supported for clients that have been associated with a WLAN through FT. For more information about PTK updates, see "Configuring WLAN security."
· To use FT, you must also specify an AKM mode.
· To use FT, enable RSN IE in the beacon and probe responses, configure the CCMP cipher suite, and do not use local authentication.
· 802.11r supports only intra-device roaming in the current software version.
· 802.11r takes effect only on clients associated with the AC.
· Before configuring 802.11r, make sure the service template is disabled.
· For APs that support 802.11be, 802.11abe, and 802.11gbe:
¡ 6GHz radios do not support the FT feature.
¡ Non-6GHz radios support the FT feature but the FT feature cannot be used together with WPA3-enterprise in 192-bit mode.
· For APs that do not support 802.11be, 802.11abe, or 802.11gbe, the FT feature is supported but cannot be used together with the WPA3 security mode.
Configuring 802.11r
1. Enter system view.
system-view
2. Enter service template view.
wlan service-template service-template-name
3. Enable FT.
ft enable
By default, FT is disabled.
4. (Optional.) Set the FT method.
ft method { over-the-air | over-the-ds }
By default, the FT method is over-the-air.
5. (Optional.) Set the reassociation timeout timer.
ft reassociation-timeout timeout
By default, the association timeout timer is 20 seconds.
The roaming process is terminated if a client does not send any reassociation requests before the timeout timer expires.
802.11v
About 802.11v
802.11v defines BSS transition management (BTM), which enables clients to roam to the optimal AP if the signal strength of the current AP is low or if a better AP is discovered.
As shown in Figure 8, BTM operates as follows:
1. If the RSSI of the currently associated AP is too low or the client discovered a better AP, the client sends a BTM query to the associated AP. Upon receiving the query, the AP responds with a BTM request.
A BTM request contains information about recommended BSSs.
2. Upon receiving the BTM request, the client determines whether to disconnect from the current AP and roam to a recommended AP.
3. If the client determines to perform a roaming, it sends a BTM response to the AP. If the client fails to leave the current BSS before the disassociation timer expires, the AP sends a disassociation request to the client and logs off the client.
Restrictions and guidelines: 802.11v configuration
802.11v supports only intra-AC roaming in the current software version.
Enabling BTM
Restrictions and guidelines
Make sure the service template is disabled before you perform this task.
For BTM to take effect on all clients, use the bss transition-management disassociation command to enable BTM disassociation.
Procedure
1. Enter system view.
system-view
2. Enter service template view.
wlan service-template service-template-name
3. Enable BTM.
bss transition-management enable
By default, BTM is disabled.
Configuring BTM disassociation
About this task
With BTM disassociation configured, an AP sends a BTM request to a client upon receiving a BTM query from the client and guides the client for BSS transition. With forced BTM disassociation configured, the AP forcibly logs off the client if the client fails to leave the current BSS before the disassociation timer expires.
Restrictions and guidelines
Forced BTM disassociation will forcibly log off a client. Use this feature with caution.
For BTM disassociation to take effect, enable BTM first.
Procedure
1. Enter system view.
system-view
2. Enter service template view.
wlan service-template service-template-name
3. Enable BTM disassociation and configure forced disassociation.
bss transition-management disassociation { forced | recommended } [ timer time ]
By default, recommended BTM disassociation is enabled and the disassociation timeout is 90 seconds.
Virtual BSS roaming
About virtual BSS roaming
Virtual BSS roaming enables multiple APs to provide the same virtual service for a client without service interruption when the client roams between the APs. When a client comes online from one AP, the other APs monitor the RSSI of the client. The AC switches the wireless service to a new AP if the AC detects that the new AP can provide higher-quality services.
As shown in Figure 9, virtual BSS roaming operates as follows:
1. The AC generates a virtual service for the client when AP 1 or AP 2 receives a probe request from the client.
The BSSID of the virtual service contains the bridge MAC address of the AC, the AP's ID, and the client MAC address. The AP uses this virtual BSSID to communicate with the client.
2. The AC notifies AP 2 of the virtual BSSID of AP 1 if the client comes online from AP 1. AP 2 replaces its local virtual BSSID with AP 1's virtual BSSID and monitors the RSSI of the client.
3. The AC notifies AP 2 to provide wireless services to the client when the following conditions are met:
¡ The RSSI of the client frames received by AP 2 reaches or exceeds the specified RSSI threshold.
¡ The gap between the RSSIs of the client frames that AP 2 and AP 1 have received reaches or exceeds the RSSI gap threshold.
Figure 9 Virtual BSS roaming diagram
Configuring virtual BSS roaming
About this task
Virtual BSS roaming configuration for a service template takes effect only on clients associated with the service template.
Restrictions and guidelines
Virtual BSS roaming supports only intra-AC roaming in the current software version.
Procedure
1. Enter system view.
system-view
2. Enter service template view.
wlan service-template service-template-name
3. Enable virtual BSS roaming.
seamless-roaming enable
By default, virtual BSS roaming is disabled.
4. Set the RSSI threshold and RSSI gap threshold for virtual BSS roaming.
seamless-roaming switch rssi-threshold value [ rssi-gap gap-value ]
By default, the RSSI threshold and RSSI gap threshold for virtual BSS roaming are 50 and 20, respectively.
Cooperative roaming
About cooperative roaming
Cooperative roaming is defined by H3C to provide AP- and wireless client-guided roaming of wireless clients in an ESS by using IEEE802.11k, IEEE802.11r, and IEEE802.11v.
· 802.11k defines Beacon radio measurement, allowing monitoring of channel quality and resource performance on both 2.4 GHz and 5 GHz channels.
· 802.11r defines Fast BSS Transition (FT) to shorten transmission delay during client roaming, reducing disconnection rate and improving the roaming service quality.
· 802.11v defines BSS Transition Management (BTM) to guide 802.11v clients to the optimal AP, improving the access service quality.
Cooperative roaming also supports using APs to monitor 802.11v client signal strength and can proactively guide clients to better services.
Restrictions and guidelines: Cooperative roaming configuration
Cooperative roaming supports only intra-AC roaming in the current software version.
To use cooperative roaming, make sure the APs support Wi-Fi 6.
Configuring client anti-sticky
About this task
This feature enables APs to examine the signal strength of clients at the specified intervals. For an 802.11v client, its associated AP triggers a BSS transition to guide the client to a better BSS if the signal strength of the client is lower than the threshold. For a non-802.11v client, no action is performed.
With client anti-sticky enabled, the system logs off a client if the signal strength of the client cannot reach the RSSI threshold. This practice might cause frequent BSS transitions and affect user experience.
To solve this issue, configure ACL-based client anti-sticky to set different RSSI thresholds for clients matching different ACL rules.
Restrictions and guidelines
ACL-based client anti-sticky takes effect only when client anti-sticky is enabled.
You can bind only one ACL rule to a radio.
You can use the display wlan client verbose command to view client RSSIs, and configure ACL-based client anti-sticky based on the RSSIs.
Configuring client anti-sticky in radio view or an AP group's radio view
1. Enter system view.
system-view
2. Enter AP view or an AP group's AP model view.
¡ Enter AP view.
wlan ap ap-name
¡ Execute the following commands in sequence to enter an AP group's AP model view:
wlan ap-group group-name
ap-model ap-model
3. Enter radio view.
radio radio-id
4. Configure client anti-sticky.
sacp anti-sticky { disable | enable [ rssi rssi-value ] [ interval interval ] [ forced-logoff ] }
By default:
¡ In radio view, a radio uses the configuration in an AP group's radio view.
¡ In an AP group's radio view, the configuration in the AP group's global radio view is used.
5. (Optional.) Configure ACL-based client anti-sticky.
sacp anti-sticky acl { acl-number rssi rssi-value | remove }
By default:
¡ In radio view, a radio uses the configuration in AP group view.
¡ In an AP group's radio view, the configuration in the AP group's global radio view is used.
If you specify the remove keyword when executing the command in radio view, the radio does not perform ACL-based client anti-sticky.
Configuring client anti-sticky in an AP group's global radio view
1. Enter system view.
system-view
2. Enter AP group view.
wlan ap-group group-name
3. Enter an AP group's global radio view.
radio { 2.4g | 5g }
4. Configure client anti-sticky.
sacp anti-sticky { disable | enable [ rssi rssi-value ] [ interval interval ] [ forced-logoff ] }
By default, client anti-sticky is enabled.
5. (Optional.) Configure ACL-based client anti-sticky.
sacp anti-sticky acl acl-number [ rssi rssi-value ]
By default, the system does not perform ACL-based client anti-sticky.
Configuring client anti-sticky in global configuration view
1. Enter system view.
system-view
2. Enter global configuration view.
wlan global-configuration
3. Configure client anti-sticky.
sacp anti-sticky enable [ rssi rssi-value ] [ interval interval ] [ forced-logoff ]
By default, client anti-sticky is enabled.
Configuring the device to not perform 802.11kv-related operations for clients that have poor support for 802.11kv
About this task
This task applies to the scenario where both clients that have good and poor support for 802.11kv exist. Clients that have good support for 802.11kv are clients that can join a better BSS through 802.11kv. Clients that have poor support for 802.11kv are clients that cannot join a better BSS through 802.11kv because of large latency or communication failure between the clients and AP.
· If you do not configure this task, the device performs 802.11kv operations for all clients, which might cause communication failure of clients that have poor support for 802.11kv.
· With this task configured, the device does not perform 802.11kv-related operations for clients that match the specified ACL. This practice not only ensures BTM disassociation of clients that have good support for 802.11kv, but also ensures network performance of clients that have poor support for 802.11kv.
Restrictions and guidelines
This task takes effect only on clients that come online after this task is configured and online clients for which an ACL matching has never been performed. To perform this task again for an online client, you must log off the client first.
This feature takes effect only on clients associated at the AC.
Procedure
1. Enter system view.
system-view
2. Enter service template view.
wlan service-template service-template-name
3. Configure the device to not perform 802.11kv-related operations for clients that have poor support for 802.11kv.
sacp roam-optimize abnormal-802.11kv acl acl-number
By default, the device performs 802.11kv-related operations for all 802.11kv-capable clients.
Enabling an AP to obtain BSS candidate information
About this task
This feature enables an AP to send Beacon requests at specific intervals to clients that support Beacon measurement and obtain information about BSSs detected by the clients. Upon receiving such a request, a client responds with a Beacon Report frame to report BSS information.
With this feature disabled, the AP stops updating BSS candidate information and deletes all the candidates after the aging time expires.
If both this feature and BSS transition management are enabled, the system can guide clients to roam to better services based on BSS candidate information.
Restrictions and guidelines
This feature takes effect only on clients that come online after the feature is configured.
To examine if a client supports beacon measurement, use the display wlan client rm-capabilities command.
Enable an AP to obtain BSS candidate information in radio view or an AP group's radio view
1. Enter system view.
system-view
2. Enter AP view or an AP group's AP model view.
¡ Enter AP view.
wlan ap ap-name
¡ Execute the following commands in sequence to enter an AP group's AP model view:
wlan ap-group group-name
ap-model ap-model
3. Enter radio view.
radio radio-id
4. Enable an AP to obtain BSS candidate information.
sacp roam-optimize bss-candidate-list { disable | enable [ interval interval ] }
By default:
¡ In radio view, an AP uses the configuration in an AP group's radio view.
¡ In an AP group's radio view, the BSS candidate obtaining feature is disabled.
Enable an AP to obtain BSS candidate information in an AP group's global radio view
1. Enter system view.
system-view
2. Enter AP group view.
wlan ap-group group-name
3. Enter an AP group's global radio view.
radio { 2.4g | 5g }
4. Enable an AP to obtain BSS candidate information.
sacp roam-optimize bss-candidate-list { disable | enable [ interval interval ] }
By default, the BSS candidate obtaining feature is disabled.
Enabling data transmission holding during roaming
About this task
With advanced data transmission holding during roaming enabled, the device caches the data packets and sends the cached packets to the client to reduce the packet loss when the client signal strength is lower than the RSSI threshold specified by client anti-sticky. With advanced data transmission holding during roaming disabled, the device ages out the cached packets after a period of time and will not send the packets to the client. As a best practice, enable advanced data transmission holding during roaming in the cooperative roaming scenario enabled with client anti-sticky.
Restrictions and guidelines
To make this feature take effect, enable client association at the AC and enable the AC to forward client data traffic.
This feature is not supported in an AC hierarchy network.
Procedure
1. Enter system view.
system-view
2. Enter service template view.
wlan service-template service-template-name
3. Enable advanced data transmission holding during roaming.
sacp roam-optimize traffic-hold enable advanced
By default, advanced data transmission holding during roaming is disabled.
Display and maintenance commands for cooperative roaming
Execute display commands in any view.
|
Task |
Command |
|
Display running configuration for the specified AP or all APs. |
display wlan ap { all | name ap-name } running-configuration [ verbose ] |
|
Display client information. |
display wlan client [ ap ap-name [ radio radio-id ] | mac-address mac-address | service-template service-template-name | frequency-band { 2.4 | 5 } | vlan vlan-id ] [ verbose ] |
|
Display radio resource measurement capabilities reported by clients. |
display wlan client rm-capabilities [ mac-address mac-address ] |
|
Display the client roaming history. |
display wlan sacp move-history [ mac-address mac-address ] |
|
Display service template information. |
display wlan service-template [ service-template-name ] [ verbose ] |
|
|
NOTE: |
Configuring mobility groups
About mobility groups
A mobility group contains multiple member devices among which clients can roam without IP or authorization changes. Mobility groups expand the scale in which clients can roam.
Terminology
· Inter Access Device Tunneling Protocol—IADTP is an H3C-proprietary protocol that provides a generic packet encapsulation and transport mechanism for devices to securely communicate with each other. Devices that provide roaming services establish an IADTP tunnel with each other to exchange control messages and client information.
· Home AC—An HA is an AC that manages the AP with which a wireless client associates for the first time.
· Foreign AC—An FA is an AC with which a client associates after inter-AC roaming.
· Mobility group—A group that contains multiple member devices among which clients can roam.
Mobility group mechanism
A mobility group enables clients to roam among APs that are managed by different ACs. These ACs must be in the same mobility group and have established an IADTP tunnel with each other.
Figure 10 Mobility group mechanism
As shown in Figure 10, inter-AC roaming uses the following procedure:
1. The client comes online from AP 2. AC 1 creates a roaming entry for the client and sends the information to AC 2 through the IADTP tunnel.
2. The client roams to AP 3. AC 2 examines the roaming entry for the client and determines whether to perform fast roaming.
If the client uses RSN + 802.1X authentication and carries the same PMKID as the AC, fast roaming is used, and the client can associate with AP 3 without reauthentication If it is not, the client must be reauthenticated before associating with AP 3.
3. The client associates with AP 3. AC 2 sends a roaming request to AC 1.
4. AC 1 verifies the roaming request and performs either of the following operations:
¡ Sends a roaming response that indicates roaming failure to AC 2 if the request is invalid. AC 2 logs off the client.
¡ Saves the roaming trace and roam-out information and sends a roaming response that indicates roaming success to AC 2 if the request is valid. AC 2 saves roaming-in information for the client.
IADTP tunnel establishment
A device in a mobility group can act as a client to initiate connection requests or act as a server to listen for and respond to the connection requests.
Figure 11 Establishing an IADTP tunnel
As shown in Figure 11, two devices establish an IADTP tunnel by using the following procedure:
1. Device A sends a join request to Device B.
2. Upon receiving the join request, Device B uses the local configuration and packet content to identify whether Device A is in the same mobility group.
¡ If they are in the same mobility group, Device B returns a join response with a result code representing success.
¡ If they are in different mobility groups, Device B returns a join response with a result code representing failure.
3. Upon receiving the join response, Device A examines the result code in the response.
¡ If the result code represents failure, Device A does not return any packets.
¡ If the result code represents success, Device A sends a join confirm to Device B.
4. Upon receiving the join confirm, Device B establishes an IADTP tunnel with Device A.
Restrictions and guidelines: Mobility group configuration
For a service template where an AP is configured as the client authenticator, WLAN roaming is not supported. For more information about client authentication, see "Configuring WLAN authentication."
For RSN + 802.1X clients from different VLANs to roam between devices within a mobility group, make sure uplink interfaces of the member devices permit all client VLANs.
Mobility group tasks at a glance
To configure mobility groups, perform the following tasks:
2. (Optional.) Setting an authentication mode for IADTP control messages
3. Specifying an IP address type for IADTP tunnels
4. Specifying the source IP address for establishing IADTP tunnels
5. (Optional.) Setting the DSCP value for IADTP keepalive packets
6. Adding a mobility group member
Perform one of the following tasks:
¡ Adding a mobility group member
¡ Adding a mobility group member
7. (Optional.) Specifying the mobility group member role of a device
8. (Optional.) Disabling IADTP data tunnels
9. (Optional.) Enabling roaming relay
11. (Optional.) Enabling tunnel isolation for mobility groups
12. (Optional.) Enabling SNMP notifications for WLAN roaming
Creating a mobility group
Restrictions and guidelines
For inter-device roaming to operate correctly, create the same mobility group and add members to each device in the mobility group.
You can create only one mobility group on the device.
Procedure
1. Enter system view.
system-view
2. Create a mobility group and enter its view.
wlan mobility group group-name
Setting an authentication mode for IADTP control messages
About this task
This feature enables the device to verify the integrity of control messages transmitted over IADTP tunnels. WLAN roaming supports only the MD5 algorithm.
Procedure
1. Enter system view.
system-view
2. Enter mobility group view.
wlan mobility group group-name
3. Set an authentication mode for IADTP control messages.
authentication-mode authentication-mode { cipher | simple } string
By default, the device does not verify the integrity of IADTP control messages.
Specifying an IP address type for IADTP tunnels
About this task
You must specify an IP address type for IADTP tunnels after you create a mobility group.
Procedure
1. Enter system view.
system-view
2. Enter mobility group view.
wlan mobility group group-name
3. Specify an IP address type for IADTP tunnels.
tunnel-type { ipv4 | ipv6 }
By default, the IP address type for IADTP tunnels is IPv4.
Specifying the source IP address for establishing IADTP tunnels
About this task
A device uses the specified source IP address to establish IADTP tunnels with other member devices within the same mobility group.
Restrictions and guidelines
You can specify one IPv4 address, one IPv6 address, or both, but only the IP address type that is the same as the IP address type for IADTP tunnels takes effect.
Make sure the mobility group is disabled before you specify the source IP address for establishing IADTP tunnels.
Procedure
1. Enter system view.
system-view
2. Enter mobility group view.
wlan mobility group group-name
3. Specify the source IP address for establishing IADTP tunnels.
source { ip ipv4-address | ipv6 ipv6-address }
By default, no source IP address is specified for establishing IADTP tunnels.
Setting the DSCP value for IADTP keepalive packets
About this task
The DSCP value of an IP packet specifies the priority level of the packet and affects the transmission priority of the packet. A greater DSCP value means a higher packet priority.
In a scenario where a device establishes IADTP tunnels with other devices across NAT devices, two devices use IPsec for tunnel encryption and establishment. To prevent IADTP tunnel disconnection because the device cannot receive any IADTP keepalive packets from the peer when the IADTP tunnel is busy, set the DSCP value by using this feature.
Restrictions and guidelines
As a best practice, set the DSCP value to 63 for IADTP keepalive packets.
Procedure
1. Enter system view.
system-view
2. Enter mobility group view.
wlan mobility group group-name
3. Set the DSCP value for IADTP keepalive packets.
tunnel-dscp dscp-value
The default setting is 0.
Adding a mobility group member
Manually adding a mobility group member
About this task
Members in a mobility group are identified by their IP addresses used to establish IADTP tunnels.
You can add both IPv4 and IPv6 members to a mobility group. Only members whose IP address type is the same as the IP address type of IADTP tunnels take effect.
You can specify VLANs for a member, so that other members in the mobility group can directly forward client data of the member from the specified VLANs. If you do not specify VLANs for the member, its client data cannot be directly forwarded by another member in the mobility group unless the clients roam to that member.
Restrictions and guidelines
A device can belong to only one mobility group.
You can add a maximum of 31 IPv4 members and 31 IPv6 members to a mobility group.
When you specify VLANs for a mobility group member, follow these restrictions and guidelines:
· If a mobility group has multiple members, make sure no loops exist among IADTP tunnels between members within the mobility group.
· Make sure the VLANs have not been used by interfaces or services.
· Do not assign VLANs that have been specified for a member to interfaces or services.
Procedure
1. Enter system view.
system-view
2. Enter mobility group view.
wlan mobility group group-name
3. Add a mobility group member.
member { ip ipv4-address | ipv6 ipv6-address } [ vlan vlan-id-list ]
Enabling automatic group member discovery
About this task
Members in a mobility group are identified by their IP addresses used to establish IADTP tunnels. You can add both IPv4 and IPv6 members to a mobility group. Only members whose IP address type is the same as the IP address type of IADTP tunnels take effect.
This feature enables a device to automatically discover member devices in a mobility group by broadcasting its source IP address in the group. Member devices in the group that receive the IP address automatically establish IADTP tunnels with the device. The device joins the mobility group after it establishes IADTP tunnels with all the other members.
Restrictions and guidelines
A device can belong to only one mobility group.
You can add a maximum of 31 IPv4 members and 31 IPv6 members to a mobility group. When the maximum number is reached, the device stops establishing IADTP tunnels with newly discovered devices.
The automatic discovery feature can add only devices in the same subnet as the source IP address.
Prerequisites
Execute the source command to specify the source IP address used for establishing IADTP tunnels.
Procedure
1. Enter system view.
system-view
2. Enter mobility group view.
wlan mobility group group-name
3. Enable automatic group member discovery.
member auto-discovery [ interval interval ]
By default, automatic group member discovery is disabled.
Specifying the mobility group member role of a device
About this task
This feature applies to a scenario where a device establishes an IADTP tunnel with another device in the same mobility group across a NAT device. In this scenario, the device with a lower IP address acts as the client to initiate a connection request to the device with a higher IP address. If the device with a lower IP address resides in the public network, the IADTP tunnel cannot be established. To ensure successful establishment of the IADTP tunnel in this case, specify the device in the private network as the client to initiate the connection request.
Procedure
1. Enter system view.
system-view
2. Enter mobility group view.
wlan mobility group group-name
3. Specify the mobility group member role of the device.
role { client | server }
By default, a member device with a higher IP address acts as the server, and a member device with a lower IP address acts as the client.
Disabling IADTP data tunnels
About this task
|
|
CAUTION: To avoid data loss, do not disable IADTP data tunnels if no service ports are specified on the device for client VLANs. |
This feature enables a device to forward client traffic directly out of client VLANs' service ports, instead of through the IADTP data tunnel. This reduces the device's workload caused by processing broadcast packets received from IADTP data tunnels and saves resources for maintaining these tunnels.
Restrictions and guidelines
You must enable or disable IADTP tunnels on all devices in a mobility group.
You can configure this feature only when the mobility group is disabled.
Procedure
1. Enter system view.
system-view
2. Enter mobility group view.
wlan mobility group group-name
3. Disable IADTP data tunnels.
data-tunnel disable
By default, IADTP data tunnels are enabled.
Enabling roaming relay
About this task
In a WLAN, client roaming will gradually turn the WLAN into a fully meshed network because any two devices must establish a tunnel with each other for roaming entry exchanging. In a large network, establishing and maintaining such tunnels can consume a lot of bandwidth resources, increasing network complexity and reducing availability. Roaming relay is introduced to resolve this issue.
With this feature configured, the device enabled with roaming relay acts as a relay device to establish an IADTP tunnel with each non-relay device, forming a star topology. Non-relay devices do not need to establish tunnels with each other. These non-relay devices synchronize roaming entries to the relay device and, upon a client roaming, request the client entry from the relay device.
Restrictions and guidelines
Make sure the mobility group is disabled before you configure this feature.
To use roaming relay, you must enable roaming relay on a device and configure the device as the only mobility group member for the other devices in the same mobility group.
You can enable roaming relay on only one device in a mobility group.
If clients belong to different VLANs, make sure the tunnel interfaces on the relay device permit packets from all client VLANs.
Procedure
1. Enter system view.
system-view
2. Enter mobility group view.
wlan mobility group group-name
3. Enable roaming relay.
roam-relay enable
By default, roaming relay is disabled.
Enabling a mobility group
About this task
This feature enables the device to establish IADTP tunnels and synchronize roaming entries with member devices.
Procedure
1. Enter system view.
system-view
2. Enter mobility group view.
wlan mobility group group-name
3. Enable the mobility group.
group enable
By default, a mobility group is disabled.
Enabling tunnel isolation for mobility groups
About this task
Tunnel isolation prevents devices from forwarding packets between tunnels in a mobility group and avoids broadcast storm when loops exist among devices in the mobility group.
Procedure
1. Enter system view.
system-view
2. Enable tunnel isolation for mobility groups.
wlan mobility-group-isolation enable
By default, tunnel isolation is enabled for mobility groups.
Enabling SNMP notifications for WLAN roaming
About this task
To report critical WLAN roaming events to an NMS, enable SNMP notifications for WLAN roaming. For WLAN roaming event notifications to be sent correctly, you must also configure SNMP on the device. For more information about SNMP configuration, see Network Management and Monitoring Configuration Guide.
Procedure
1. Enter system view.
system-view
2. Enable SNMP notifications for WLAN roaming.
snmp-agent trap enable wlan mobility
By default, SNMP notifications for WLAN roaming are disabled.
Display and maintenance commands for mobility groups
Execute display commands in any view.
|
Task |
Command |
|
Display information about clients that have roamed to or from the device. |
display wlan mobility { roam-in | roam-out } [ member { ip ipv4-address | ipv6 ipv6-address }] |
|
Display mobility group information. |
display wlan mobility group [ member { ip ipv4-address | ipv6 ipv6-address } ] |
|
Display the number of roamings for each client on the HA. |
display wlan mobility roam-count |
|
Display roam-track information for a client on the HA. |
display wlan mobility roam-track mac-address mac-address |