Wireless roaming is a big part of wireless network deployments, configurations,
and designs.
The idea here is that we need to cover a lot of space, therefore we're going to
need a
lot of access points.
And if I'm a user on a mobile device here, maybe I've got a video call going on
my phone
and I'm connected to this access point on the left, well, I'm very likely to be
mobile
with my mobile device.
That's why we call them mobile devices.
And now all of a sudden I'm over here, apparently bending over almost backwards WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And now all of a sudden I'm over here, apparently bending over almost backwards
with my phone,
maybe trying to get a good angle for my video call.
But either way, we are now connecting probably to a different access point.
And this process is known as a ROM.
Before we really jump into the weeds of wireless networking, we might just
think that this
is a very easy process.
I am connected to this access point.
Now I'm connected to this access point and life should be good.
However, there's a lot of implications to this. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
However, there's a lot of implications to this.
First and foremost, just performing a ROM itself, just from an 802.11
perspective, is
going to be very disruptive.
I have to actually issue a association request here to get onto the access
point to start
with.
And then I have to initiate a re-association request over on this side to
suggest that I
want to roam.
But keep in mind that there's an authentication part to this.
I need to make sure that I'm allowed to be on the access point on this Wi-Fi WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
I need to make sure that I'm allowed to be on the access point on this Wi-Fi
connection.
So there's a back and forth negotiation here.
And then when I perform re-association, I'm going to have to perform back and
forth
negotiations.
And I'm going to have to make sure that I'm allowed to be on the Wi-Fi again.
And this whole process, before we even get into anything connected on the back
end of
the access points, is going to require a lot of time.
And this alone might make it so that I drop my video call, even if it's for a
couple of
seconds before it comes back. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
seconds before it comes back.
But for some video calls, that means that that call will get dropped.
And that is again very disruptive.
Now one thing we might consider trying to do is to make the environment a
little bit
more favorable as far as creating ROMs.
So one of the things we can do is deploy our access points.
So there's a lot of overlap, meaning that when I'm walking this direction, even
by the time
I say, okay, I'm going to roam over to this new AP, ideally I still have really
good signal
to the previous access point. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to the previous access point.
But it's always worth noting that the ROM is not a decision that's made by the
access
points, but rather it's decided by the device itself, by the wireless station.
And so this is something that as network admins can make us very upset and
frustrated with,
is we have no control over these devices and when they decide to roam.
Why do they roam?
Well, they're going to be paying attention to the RSSI, that's that received WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Well, they're going to be paying attention to the RSSI, that's that received
signal strength
indicator of the access point they're connecting to.
They're going to pay attention especially to that signal to noise ratio, the SN
R.
We covered these concepts earlier on in the course.
And so they're going to largely just be looking at their signal strength.
And at some point, they have to decide that it's time to roam.
Now this takes a little bit of nuance because we might think, okay, well, again
, maybe this
is straightforward, I get close to another access point over here and my device
decides
to roam. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to roam.
That is maybe a little bit true, but we have to find a balance.
So imagine if I as a user, I sit apparently very crooked here, still having
some problems.
But I sit at my desk every day doing my work and my mobile devices here and I
happen to
have an office that's between two access points.
Now if this mobile device was just constantly looking at to say, hey, which of
these is
better, chances are that changes throughout the day. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
better, chances are that changes throughout the day.
So maybe this access point on the left is better when I sit down at the start
of the day.
And so I associate to this AP.
But then a few minutes later, this access point actually appears like it's
going to be better.
And this goes back and forth.
Well, I certainly don't want this mobile device to be performing something
disruptive like
a roam constantly throughout the day.
So there's a threshold here.
We're saying, hey, yeah, maybe this access point on the right here, let's say
it's a
negative something like 63 dBm. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
negative something like 63 dBm.
And this over on the left, I've been associated to it for a while.
But for whatever reason, it's now looking bad.
This is a negative 68 dBm, just still a really good signal.
But maybe not quite as good for voice calls.
Well, is this enough of a signal difference to say, let's go ahead and do a
disruptive
roam.
It depends on the client.
Again, we don't get to control that as the network admins for the most part.
We are just going to have to hope that these devices stay stable. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We are just going to have to hope that these devices stay stable.
And so it's a matter of saying, well, now this is a negative 75.
This is a really bad signal.
We do need to trigger in those situations, but we don't want to be stuck just
constantly
roaming back and forth.
So be aware that our wireless stations get to make those decisions.
And sometimes there's not a lot we can do about that on the networking side.
Now, in addition to having just the whole roam and associate and re-associate
process, WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
process,
we have to worry a little bit about what's on the back end here behind the
access points.
So when we look at autonomous access points, so this is before lightweight, we
have our
access points here, and they're connecting maybe into some kind of switched
infrastructure.
And I'm going to perform this roam.
Well, like we mentioned, we have to do, in order to make this roam happen, we
have to
do our authentication and our security.
And so this is going to allow me to make sure that I'm allowed to be again on WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And so this is going to allow me to make sure that I'm allowed to be again on
this network.
One thing that we can do, or we were able to do with autonomous access points
back in
the day, was have a shared key mechanism, which would allow this access point
over here to
tell the new AP, because I'm over here, tell that access point, hey, this
person is allowed
to be on the network.
And so this was especially common with deploying into Cisco networks.
We'd have CCKM, for example, which is Cisco centralized key management. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
We'd have CCKM, for example, which is Cisco centralized key management.
And it would allow us to effectively skip the authentication process on a new
access
point, even though this was an autonomous architecture, meaning each AP was
configured
individually, technology such as CCKM would allow us to greatly speed up the
roaming process.
But this was largely required because each access point was its own entity.
Well, now let's look at things from a lightweight perspective. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
Well, now let's look at things from a lightweight perspective.
When we have a lightweight architecture, we have a wireless LAN controller.
And the wireless LAN controller might have two different access points.
And I want to perform the ROM now from one AP to the other on the same
controller.
Well, at that point, the keys are being managed by the controller.
And so I can receive the key and then forward it down to the new AP.
And now it happens as part of a centralized architecture.
So we can skip the authentication mechanism as well. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So we can skip the authentication mechanism as well.
However, now we have to think about what happens if we have two wireless LAN
controllers.
And we have two different access points that are connecting to the two
different
WLCs, and I want to roam from one to the other.
Well, now we're going to find that we need some communication back and forth
between
the wireless LAN controllers.
And so we're still going to need some form of key management to allow us to
pass keys
back and forth.
But that is going to be a big part of speeding up the roaming process. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
But that is going to be a big part of speeding up the roaming process.
Now there's another big aspect to roaming.
And this has to do with layer two versus layer three.
If we think about it, an access point is essentially like a switch.
It's a wireless bridge.
It has a physical connection here and it has a wireless connection here, but it
's really
just switching traffic back and forth at layer two.
It's a layer two device.
So if I have a mobile device here and it's on an SSID, this SSID might be on a
specific
VLAN like VLAN five. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
VLAN like VLAN five.
And then that either gets chunked or not, either way, maybe it's an access port
, but
it gets handed off to a switching infrastructure here.
And so if I want to roam to another access point, maybe this access point, by
the way,
is just part of the same layer to domain.
It's not part of the same switch.
It's not connected to the same switch, but VLAN five exists throughout this
whole infrastructure
because of trunk links.
And so if I want to roam over to this new AP, I can just get on to that same SS WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
And so if I want to roam over to this new AP, I can just get on to that same SS
ID and
be part of VLAN five and nothing changes.
Maybe my p address is something like 10 dot 10 dot five dot one 31, where five
is the
subnet that is associated with VLAN five.
So once I roam, I'm still on VLAN five, I can still be dot one 31.
Life is still good.
Well, here's the question.
What happens then if I'm going to end up roaming through a layer three boundary WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
What happens then if I'm going to end up roaming through a layer three boundary
?
So now we have an access point over here and it's advertising the same SSID,
but it's
associated with a different VLAN.
It's let's say VLAN 11.
So now can I roam this way?
Well, I can technically roam.
It's the same SSID.
It's the same network name, but now can I maintain my same IP address in the
autonomous
world?
The answer is no, I cannot. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
The answer is no, I cannot.
And the reason for that is because VLAN five doesn't exist over here.
That subnet doesn't exist.
If if a packet comes in destined for 10 dot 10 dot five, that would be the sub
net I'm
on.
And let's just say it's a slash 24.
What's the layer three device going to do?
It's going to forward it this way because this is where that subnet lives.
So if my wireless device is now over here, trying to use 10 dot 10 dot five dot
one thirty
one, at that point, we're not going to ever get traffic because we performed a WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
one, at that point, we're not going to ever get traffic because we performed a
layer three
roam as such.
This is even more disruptive than having to do re association and reauthent
ication because
now I have to get a new address.
I have to do DHCP, I have to get a 10 dot 10 dot 11 dot whatever address.
And so I've got to get a new IP address by the time that process completes, not
only
does that take a while, but on top of that, now I no longer have this IP WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
does that take a while, but on top of that, now I no longer have this IP
address.
So whatever sessions I was in, maybe it was a video call, for example, I'm
probably going
to drop that call immediately because it's looking for this IP address and I
now have
a new IP address.
So a layer two Rome, we'll change colors here a little bit.
So a layer two Rome is exactly what we saw here, roaming between access points
that's
part of the same layer two domain.
Layer three roaming is what we saw down here, where we roamed to a new access
point with WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
point with
the same SSID, but it's part of a different routed network, at least over on
that side
of a layer three boundaries, where we have new subnets and new VLANs.
So a layer three Rome must be avoided at all costs.
Now a lightweight architecture might have a little bit something to say about
helping
us out with that.
For example, now we have wireless LAN controllers.
So is that going to be able to help us out? WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
So is that going to be able to help us out?
Because maybe these access points are still part of a different layer three
network.
This access point roaming to this access point, if they're part of, they're
basically in the
same architecture where they're on opposite sides of a layer three boundary,
what does
this Rome end up doing?
Well this Rome ends up still being a layer two Rome, thanks to the wireless LAN
controller.
This is a way that lightweight architectures greatly help us out because we
have the ability
to centralize a lot of our operations via the controller. WEBVTT X-TIMESTAMP-MAP=LOCAL:00:00:00.000,MPEGTS:900000
to centralize a lot of our operations via the controller.
So this is a presentation largely of the challenges that we have with roaming
in a wireless environment.
Roming is almost never good, however we do have things that we can do to
improve it,
such as improving our authentication.
But when it comes to layer two and layer three roaming, there might even be
things that we
can do in lightweight to mitigate the effects of that.
And we're going to take a look at that in the next video.