802.11r Fast Roaming

The 802.11r protocol uses the Fast BSS Transition (FT) function to reduce the number of information exchanges between users in the same mobile domain (MD) and does not require 802.1X authentication or key negotiation during STA roaming. Users are unaware of service interruption and experience low-latency data services during roaming, so their online experience is improved.

802.11r fast roaming supports the following two modes:

Over-the-Air: STAs communicate directly with the FAP for FT authentication.
Over-the-DS: STAs communicate with an AP for FT authentication through the HAP.

Currently, Huawei ACs support only the over-the-Air mode.

Intra-AC 802.11r Fast Roaming

Figure 1 shows the intra-AC 802.11r fast roaming process.

Figure 1 Intra-AC 802.11r fast roaming

When a STA is connected to the Internet through AP_1 for the first time, the STA is authenticated by AC and a PMK is generated.
1. The AC generates PMK-R0 (calculated based on the SSID, MDID, AC MAC address, and STA MAC address) and PMK-R1 of each AP based on the PMK (calculated based on the PMK-R0, AP MAC address, and STA MAC address), and delivers the PMK-R1 to AP_1.
2. The STA and AC generate and install the pairwise transient key (PTK) and the group temporal key (GTK) by performing the 4-way and 2-way handshakes.
If open system authentication is used, no PMK is generated.
The STA initiates an 802.11 FT authentication request to AP_2 during roaming, and delivers the PMK-R1 to AP_2.
After receiving the request, AP_2 generates and installs a PTK according to PMK-R1 and information contained in the request frame. At the same time, AP_2 starts the re-association timer, and sends an 802.11 FT authentication response to the STA.

If 802.1X authentication is used, the AP reports FT authentication information to the AC for processing during FT authentication. If open system or PSK authentication is used, the AP does not report FT authentication information.
After receiving the response, the STA generates and installs a PTK based on the information contained in the response frame. The STA sends AP_2 a re-association request.
After receiving the re-association request, AP_2 disables the re-association timer, and then sends a re-association response to the STA.

If a STA blacklist or whitelist is configured on the AC, the AP reports re-association responses to the STA during FT re-association and then reports the STA's re-association request to the AC for processing.
After the STA receives the response frame, the roaming is complete.