Design the wireless network for mobility
Domain 4: Design the wireless network for mobility
This domain tests roaming design: mobility groups, mobility lists, inter-controller and inter-subnet roaming, and anchor/foreign tunnels. The key skill is choosing the simplest mobility model that preserves client IP addresses without stretching latency.
Mobility building blocks
A mobility group is a set of controllers that share roaming information; the mobility list tells each controller which groups it can reach. Intra-controller roaming stays inside one WLC. Inter-controller L2 roaming uses a mobility tunnel while the client keeps its IP address on the same subnet. Inter-controller L3 roaming uses a foreign/anchor relationship: the foreign WLC tunnels client traffic to the anchor, which owns the client subnet, so the client keeps its address. Guest traffic commonly uses a dedicated anchor in a DMZ.
Design rules
Keep mobility group members in the same campus or metro area with low, stable latency; do not stretch a mobility group across a high-latency WAN. Put all controllers that serve a common roaming domain into the same mobility group and verify that every member appears in every mobility list. Size mobility tunnels for client throughput, not just control traffic. For Catalyst 9800, confirm interoperability and code compatibility with AireOS peers before designing a mixed mobility group. Use auto-anchor for guest mobility when guests must keep an address across controllers, and place the anchor where the traffic should egress.
Worked example
Three buildings each have a Catalyst 9800-L pair. Employees roam between buildings and must keep their IP address. The buildings are on one campus with less than 10 ms RTT, so all six controllers go into one mobility group and each mobility list contains all members. Client VLANs exist on every controller so L2 roaming is possible; where a VLAN does not exist, the foreign controller anchors the client to the controller that owns the subnet. Guest traffic is anchored to a separate DMZ anchor, not to the employee mobility group. The reasoning: low latency permits a single group; guest isolation requires a separate anchor.
Traps
- Assuming L3 roaming works without an anchor.
- Forgetting to add every controller to the mobility list.
- Stretching a mobility group across a WAN.
- Sizing only control traffic, not data throughput.
- Mixing incompatible code versions.
- Anchoring guest traffic to an internal controller.