Client Connectivity, Mobility, and Roaming
Getting a client on the network
A client joins in stages: probe/scan (active or passive), open 802.11 authentication, association, security (802.1X/EAP or PSK with the 4-way handshake), then DHCP and ARP. A failure at any stage looks like “can't connect,” so troubleshooting must identify the stage - association failures point at RF or configuration, while DHCP failures point at VLAN or anchor path issues.
Fast roaming toolkit
Re-authenticating to RADIUS on every roam is slow, so Cisco supports PMK caching (controller remembers the PMKID), OKC (client and controller derive the PMK from a cached key), 802.11r fast transition with key hierarchies, 802.11k neighbor reports to cut scan time, and 802.11v BSS transition management to steer clients. CCKM is the legacy Cisco-only method.
Mobility groups and tunnels
Roaming within a controller is trivial. Roaming between controllers in the same mobility group works without tunneling the client subnet when the VLAN is available at both. When it is not - or across mobility groups - an anchor/foreign relationship tunnels traffic so the client keeps its original IP address (Layer 3 roaming).
Traps: 802.11r needs consistent mobility domain configuration and is not universally supported by clients; OKC requires the controllers to share the same WLAN security configuration; a “sticky client” stays on a far AP and is fixed by band steering, 802.11k/v, or aggressive roaming thresholds, not by adding power.
Rule of thumb: Layer 2 roam = same subnet and IP preserved; Layer 3 roam = different subnet, IP preserved only through an anchor tunnel.