Implementing Cisco Wireless High Availability and Mobility
The Implementing Cisco Wireless High Availability and Mobility domain tests controller redundancy design (SSO pairs and N+1 fallback) and client roaming between controllers, including fast-roam methods and anchor relationships.
High availability
- AireOS SSO: active/standby pair with a dedicated redundancy port (direct cable preferred), continuous configuration sync, and sub-second switchover. AP SSO keeps APs joined across the switchover; the fast-heartbeat timer governs how quickly APs detect a dead controller.
- Catalyst 9800: chassis-level redundancy using the redundancy management interface (RMI) and redundancy port; verify pairing with
show redundancy(ACTIVE / STANDBY HOT) before trusting a failover. - N+1: primary, secondary and tertiary controllers configured in the AP join settings; APs fall back using fast heartbeat when their controller is unreachable.
Mobility
- All roaming peers must share the same mobility group name and a mobility list containing each peer's controller MAC and IP; tunnels use EoIP over UDP 16666/16667.
- Intra-controller roaming uses the same controller; inter-controller roaming uses the mobility tunnel. An L2 roam keeps the client in the same subnet; an L3 roam keeps the client IP and tunnels traffic back through the foreign controller.
- Fast roam techniques: PMK caching, OKC, 802.11r fast transition (FT), and legacy CCKM - the client must support the method for it to help.
- Anchoring (guest or auto-anchor) pins a WLAN's traffic to a designated anchor controller.
Worked example
After a Catalyst 9800 switchover every AP reboots and clients re-associate. Reasoning: the pair failed over (traffic resumed), but AP sessions were not synchronized - the APs joined before the pair was fully formed, images differ, or AP SSO/fast heartbeat is misconfigured. Check show redundancy history, confirm identical software on both units, then reboot APs cleanly while the pair is healthy.
Traps that cost marks
- Mobility group name mismatch or an asymmetric mobility list, so no tunnel forms.
- Assuming an L3 roam works without a working mobility tunnel and matching WLANs.
- Anchor WLAN missing on one side of the tunnel.
- HA pair running different images or unsynchronized NTP, which blocks clean stateful switchover.