FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
Neesha
Staff
Staff
Article Id 380986
Description This article describes how AP handoff is configured in FortiAP and when it is recommended to be enabled.
Scope FortiAP.
Solution

How AP Handoff Works:

  1. Client-AP Association.
  • A client connects to FortiAP through normal association process, get a radio assigned and starts sending traffic.
  1. Monitoring Signal Strength and Load.
  • FortiAP continuously monitors RSSI and SNR of connected clients. If the signal strength drops below a configured threshold or a better AP is available nearby, the AP determines if a handoff is required.
  1. Triggering the Handoff.
  • The AP decides whether to trigger a handoff based on:
    • Nearby APs in the same SSID.
    • Their signal strength relative to the client.
    • The number of clients already connected (load balancing considerations).
    • If another AP offers a better signal, then the client is forced to roam to it.
  1. Forcing the Client to Disconnect.
  • The current AP sends a Disassociation or Deauthentication frame to the client.
  • This forces the client to search for a new AP.
  • If 802.11k/v/r roaming enhancements are enabled, the transition is smoother.
  1. Client Reassociation to a New AP. The client device scans for a better AP and connects to it.
  • If fast roaming (802.11r) is enabled, the client can transition with minimal latency.

AP Handoff should be enabled in the following scenarios:

  • High-Density Environments (e.g., stadiums, auditoriums, office buildings) to ensure optimal load balancing.
  • Enterprise Networks where seamless roaming is required to maintain application performance.
  • Retail, Warehouses, and Healthcare Facilities where mobile devices, barcode scanners, or VoIP phones require stable connectivity.
  • Campus Networks where users frequently move between buildings and need smooth transitions between AP's.

However, enabling AP Handoff without proper tuning may result in unwanted disconnections. A poorly configured network can cause excessive handoffs, leading to degraded user experience instead of improving it. 

Things to consider while setting the thresholds.

  • Sticky Clients: Some client devices may resist roaming and reconnect to the same AP even after disassociation.
  • Frequent Disconnections: If AP handoff thresholds are too aggressive, users may experience frequent drops.
  • Roaming Delays: Some older devices do not support fast roaming features like 802.11k/v/r, leading to slower re-connections.

WiFi Event Log Examples:

 

Below are sample logs that indicate an AP handoff event:

 

date=2025-02-27 time=14:35:21 id=7372210272947143044 logid=0104043657 type="event" subtype="wireless" level="notice" action="client-disassociated" msg="Client ab:cd:ef:gh:12:34 was disassociated due to AP handoff" logdesc="Wireless station disassociation" ssid="Corporate-WiFi" ap="AP-1" reason="AP handoff triggered" stamac="ab:cd:ef:gh:12:34"

date=2025-02-27 time=14:35:23 id=7372210272947143045 logid=0104043595 type="event" subtype="wireless" level="notice" action="client-associated" msg="Client ab:cd:ef:gh:12:34 successfully associated with AP-2 after handoff" logdesc="Wireless station association" ssid="Corporate-WiFi" ap="AP-2" stamac="ab:cd:ef:gh:12:34"


These logs show that the client was disassociated from AP-1 due to AP handoff and then reassociated with AP-2 for a better connection. 

Contributors