Wireless Roaming: BSS, ESS, and Fast Roaming

Wireless roaming refers to the process by which a Wi-Fi client moves from one access point (AP) to another while maintaining an active network connection. In a wireless LAN, each AP creates a Basic Service Set (BSS), which is a coverage area identified by a BSSID (the MAC address of the AP's radio). When multiple APs are connected to the same wired network and share the same SSID (network name), they form an Extended Service Set (ESS). Roaming within an ESS allows a client to move seamlessly between APs without re-authenticating to the network, provided the roaming is handled correctly.

Roaming is necessary because Wi-Fi has limited range. An AP typically covers 30-50 meters indoors. In large environments like offices, campuses, or hospitals, multiple APs are deployed to provide continuous coverage. Without roaming, a client would need to disconnect from one AP and manually connect to another, causing service interruption. Roaming automates this transition, enabling mobility for voice calls, video streaming, and real-time applications.

Roaming can occur at Layer 2 (same subnet) or Layer 3 (different subnets). Layer 2 roaming is simpler: the client's IP address remains the same because all APs are on the same VLAN/subnet. The client simply reassociates with a new AP, and the switch learns the new MAC-to-port mapping via transparent bridging. Layer 3 roaming requires the client to obtain a new IP address or use a tunneling protocol like CAPWAP to keep the original IP. Most enterprise Wi-Fi deployments use a controller-based architecture where the controller handles mobility, allowing Layer 3 roaming transparently.

On a Cisco wireless controller (WLC), fast roaming is configured under the WLAN settings:

config wlan security ft {enable|disable} {wlan_id}
config wlan security ft over-the-ds {enable|disable} {wlan_id}

To verify roaming behavior on a client, use:

show client detail <client_mac>

Look for fields like "Roaming History" or "FT Status". On a Linux client, you can use:

iw dev wlan0 link

To see the current BSSID and signal strength. For debugging, use:

iw dev wlan0 station dump

This shows roaming statistics like "connected time" and "signal avg".

Over-the-Air (OTA) vs. Over-the-DS (DS): 802.11r defines two methods for key distribution. In OTA, the client receives the PMK during the initial authentication and uses it with the new AP over the air. In DS, the current AP forwards the PMK to the new AP via the distribution system (wired network). OTA is more common in enterprise deployments.

PMK Caching: The client and AP cache the PMK after initial 802.1X authentication. When roaming, the client sends a reassociation request with a PMKID derived from the cached PMK. The new AP checks its cache and, if found, proceeds with a 4-way handshake using the cached PMK, reducing latency.

Opportunistic Key Caching (OKC): A proprietary Cisco implementation that caches PMKs on all APs in the same mobility group. When a client roams, the new AP already has the PMK, so full authentication is skipped. OKC is similar to 802.11r but not standardized.

A large hospital deploys Wi-Fi for voice-over-Wi-Fi (VoWiFi) phones used by doctors and nurses. The network has over 200 APs across multiple floors. The primary requirement is seamless roaming with less than 50 ms latency to avoid call drops. The network uses 802.11r (Fast BSS Transition) and 802.11k for neighbor reports. The APs are configured with the same SSID and security (WPA2-Enterprise with PEAP). The controller enables fast roaming and sets the PMK cache timeout to 24 hours. During deployment, engineers discovered that some older phone models did not support 802.11r, causing call drops. They had to upgrade the phones or segment them onto a separate SSID without fast roaming. Properly configured, the roaming latency stays under 30 ms, ensuring clear calls even when moving between floors.

A university provides Wi-Fi for thousands of students in lecture halls, libraries, and dormitories. The network uses a controller-based architecture with APs on different subnets per building. Layer 3 roaming is handled by the controller using CAPWAP tunneling. The network uses 802.11v to encourage clients to roam to less congested APs. During peak hours, some clients stick to a weak AP because they don't scan aggressively. The engineers enable BSS Transition Management (802.11v) to send disassociation hints to clients with poor signal. They also set the RSSI threshold to -72 dBm for roaming triggers. Misconfiguration of the VLAN mapping caused some clients to lose connectivity when roaming between buildings because the new AP assigned a different VLAN. The fix was to ensure all APs in the same mobility group use the same VLAN for the SSID.

A retail chain uses Wi-Fi tablets for inventory management. The store has 10 APs covering a 50,000 sq ft area. The tablets run a custom app that requires constant connectivity. The network uses WPA2-PSK with fast roaming (802.11r) to reduce latency. However, the tablets did not support 802.11r initially, so roaming took over 500 ms, causing the app to time out. The vendor released a firmware update enabling 802.11r, which reduced roaming to under 100 ms. The engineers also noticed that some tablets were roaming unnecessarily due to signal fluctuations. They adjusted the roaming aggressiveness setting on the tablets to medium. Additionally, they enabled PMK caching on the APs to avoid full re-authentication on each roam.