Protocol Atlas

L2 · wireless · draft

802.11

IEEE 802.11 association and roaming

Stations probe, authenticate, and associate; WPA2/3 completes a 4-way handshake. Roaming and CAPWAP (RFC 5415) separate air from AP–controller tunnels.

Presenter modeEmbed this figure

IEEE 802.11-2020 §4IEEE 802.11-2020 §12IEEE 802.11-2020 §12.4IntroductionRFC 5415 · PROPOSED STANDARD · March 2009

Why it exists

Stations need a standardized way to discover BSSs, authenticate, associate, and protect frames on a shared medium. IEEE 802.11-2020 §4

Enterprise APs are often lightweight: CAPWAP (RFC 5415) tunnels AP–controller traffic while 802.11 still governs the air interface. IntroductionRFC 5415 · PROPOSED STANDARD · March 2009

Associate then complete the 4-way handshake

Association creates the 802.11 state machine relationship. For WPA2/WPA3 personal or enterprise, pairwise keys are proven with a 4-way handshake before data frames are usefully protected.

STA802.11 associate802.11: associatedAPWLC / CAPWAP
  • Link
  • Blocking
  • Packet in flight
  • Discarded
  • Emphasis
Select a device to read its state. Arrow keys walk the topology.
Text equivalent of this diagram
Devices and links at this step
ElementKindState
STAhost802.11: associated
APswitch—
WLC / CAPWAPcloud—
STA — APlinkup
AP — WLC / CAPWAPlinkup
1 / 3

After open-system authentication, the STA sends Association Request; the AP responds with Association Response and an AID. The STA is associated but not yet fully secured for WPA.

What changed

  • 802.11 associate
  • STA: 802.11 → associated

How it works

Discovery (probe/beacon), authentication, and association establish 802.11 state. Robust security then runs 802.1X and/or a 4-way handshake to install keys. IEEE 802.11-2020 §12.4

Reassociation moves the STA between APs. Fast BSS Transition (802.11r) and assist features (k/v) reduce roam cost but do not invent L3 continuity. IEEE 802.11-2020 §12

CAPWAP splits control and data paths between AP and Wireless LAN Controller. Troubleshooting must separate RF/association from CAPWAP/DTLS and from DHCP/VLAN design. IntroductionRFC 5415 · PROPOSED STANDARD · March 2009

On the wire

Constructed examples, encoded from the field table below them — not captured traffic.

An ordinary frame. The group bit in the first octet of the destination is clear, so a switch forwards it to one port rather than flooding it.

Physical
A preamble and start-of-frame delimiter precede this, and the hardware removes them before any capture sees the frame. IEEE 802.3-2022
MAC header
Destination address, source address, and the EtherType naming the payload. IEEE 802.3-2022
Payload and FCS
Between 46 and 1500 octets, padded to the minimum, followed by a four-octet frame check sequence. IEEE 802.3-2022

Configure it

WLAN with WPA2-PSK profile so STAs associate and complete a 4-way handshake.

Cisco IOS-XE Wireless (Catalyst 9800) 17.12 · Catalyst 9800draft

  1. wlan LAB-WIFI 1 LabWifi
 broadcast-ssid
 security wpa psk set-key ascii 0 <configured out of band>
 security wpa wpa2 ciphers aes
 no shutdown

    SSID advertisement plus WPA2-PSK. Association alone is insufficient — clients still run the 4-way handshake to install keys (IEEE 802.11 RSNA).

    Common mistake: Treating “client associated” in the WLC UI as proof that the 4-way handshake and DHCP succeeded.

    IEEE 802.11-2020 §12.4

  2. wireless profile policy LAB-POLICY
 vlan 20
 wlan LAB-WIFI policy LAB-POLICY
ap profile default-ap-profile

    Map the WLAN to a VLAN via a policy profile. CAPWAP (RFC 5415) carries AP–WLC control/data while 802.11 runs on the air.

    Common mistake: Changing VLAN on roam domains without planning DHCP — sticky IP assumptions break.

    RFC 5415 §1

Verify

show wlan summary
LAB-WIFI enabled; security WPA2.
show wireless client summary
Clients reach Run state after association and key install.

Caveats

  • Marked draft: 9800 profile/tag model varies by release; treat as teaching shape.
  • PSK shown as placeholder — never commit real passphrases.
  • AP join, site tags, and RF profiles omitted for brevity.

When it breaks

Symptom first, because that is what you have when it happens.

  1. Client shows connected but cannot pass traffic.

    Narrow it down

    1. Check whether the 4-way handshake completed.
    2. Verify AAA (if 802.1X) and DHCP after keys install.

    Cause

    Association succeeded without a completed RSNA / addressing path.

    Fix

    Debug EAPOL-Key and AAA; confirm DHCP and ACL policy after connect.

    IEEE 802.11-2020 §12

  2. Client stays on a distant AP with poor throughput.

    Narrow it down

    1. Compare RSSI/SNR on associated versus neighboring APs.
    2. Review client roam thresholds and controller assist features.

    Cause

    Client roam algorithm held the BSS too long.

    Fix

    Tune RF power/channels; enable assist where appropriate; educate sticky device behavior.

    Cisco IOS XE Wireless — Configuration Guide §Client Roaming

  3. Applications drop after walking between buildings.

    Narrow it down

    1. Check whether the new AP maps to a different VLAN/subnet.
    2. Look for DHCP renew and new address assignment.

    Cause

    L3 boundary crossed without mobility anchoring.

    Fix

    Keep roam within a mobility/VLAN design that preserves IP, or accept reconnect.

    Cisco IOS XE Wireless — Configuration Guide §Mobility

  4. AP radios up locally but clients never get central policy.

    Narrow it down

    1. Check CAPWAP/DTLS state to the WLC.
    2. Verify AP join credentials and reachability.

    Cause

    AP–controller tunnel failed while RF still beacons in some modes.

    Fix

    Restore CAPWAP path and certificates; confirm WLC capacity.

    IntroductionRFC 5415 · PROPOSED STANDARD · March 2009

  5. Association and keys OK; client stuck at obtaining IP.

    Narrow it down

    1. Trace DHCP from client VLAN through WLC/AP anchoring.
    2. Confirm helper addresses and pool availability.

    Cause

    L3 services failed after 802.11 success.

    Fix

    Repair DHCP path and VLAN mapping; do not only debug RF.

    Cisco IOS XE Wireless — Configuration Guide §VLAN / Mobility

Design notes

Sticky clients are usually client algorithms, not “broken APs.” Fix RF design and roam assist; do not only reboot the WLC.

SSID → VLAN mapping decides whether roam preserves IP. Voice SSIDs often need careful mobility domains. Cisco IOS XE Wireless — Configuration Guide §VLAN / Mobility

Misconceptions

“Association Response means the session is fully secured.”
Association is an 802.11 state. WPA2/3 still requires the 4-way handshake (and 802.1X when used) before RSNA is complete. IEEE 802.11-2020 §12.4
“The infrastructure always forces clients onto the best AP.”
Roam decisions are primarily client-driven. Controllers can assist or deauth, but sticky devices remain common. Cisco IOS XE Wireless — Configuration Guide §Client Roaming
“Any successful roam keeps the same IP address.”
IP continuity requires same subnet or mobility anchoring. Crossing VLANs forces DHCP and breaks address-bound sessions. Cisco IOS XE Wireless — Configuration Guide §Mobility

More walkthroughs

Sticky client holds a weak APfailure

Client roaming algorithms often prefer holding an associated AP until RSSI collapses. The user experiences “Wi-Fi is slow” while a stronger AP is ignored.

STA · stickyHolds weak BSSRSSI: marginalAP · weakAP · strong
  • Link
  • Blocking
  • Packet in flight
  • Discarded
  • Emphasis
Select a device to read its state. Arrow keys walk the topology.
Text equivalent of this diagram
Devices and links at this step
ElementKindState
STA · stickyhostRSSI: marginal
AP · weakswitch—
AP · strongswitch—
STA · sticky — AP · weaklinkup
STA · sticky — AP · stronglinkdown
1 / 3

The STA remains associated to the distant AP. Throughput falls and retries rise, but the client’s roam threshold has not fired.

What changed

  • Holds weak BSS
  • STA · sticky: RSSI → marginal

L2 roam versus DHCP disruptiondesign-choice

Same-subnet roaming preserves the IP. Crossing a VLAN/subnet boundary without seamless mobility forces DHCP renew/rebind and breaks sessions that bind to the old address.

STASame subnet preferredAP · VLAN 10AP · VLAN 20DHCP
  • Link
  • Blocking
  • Packet in flight
  • Discarded
  • Emphasis
Select a device to read its state. Arrow keys walk the topology.
Text equivalent of this diagram
Devices and links at this step
ElementKindState
STAhost—
AP · VLAN 10switch—
AP · VLAN 20switch—
DHCPcloud—
STA — AP · VLAN 10linkup
STA — AP · VLAN 20linkdown
AP · VLAN 10 — DHCPlinkup
AP · VLAN 20 — DHCPlinkup
1 / 3

Intra-VLAN roam/reassociation keeps the client on the same subnet. Existing TCP sessions can survive if the key hierarchy and forwarding path update quickly (FT helps).

What changed

  • Same subnet preferred

Check yourself

  • What does 802.11 association establish?
  • What does the 4-way handshake confirm?
  • What is a sticky client?
  • Does reassociation alone guarantee the same IP address?
  • What does RFC 5415 define?
  • Why might DHCP run again after a roam?
  • How does 802.1X fit enterprise Wi-Fi?
  • Where should sticky-client troubleshooting start?