Fast Roaming

[srappaport]

The manual describes Fast Roaming as:

Fast Roaming Users in a multi-AP network, especially with mobile devices, can move from one AP coverage area to another. But, the process of re-authentication can often take seconds to complete and this can impair wireless voice traffic and time sensitive applications. The FortiAP fast roaming feature solves this problem and is available only when movingbetween FortiAP units managed by the same FortiGate unit. Fast roaming uses two standards-based techniques: • Pairwise Master Key (PMK) Caching enables a RADIUS-authenticated user to roam away from an AP and then roam back without having to re-authenticate. To accomplish this, the FortiGate unit stores in a cache a master key negotiated with the first AP. This enables the 802.11i-specified method of “fast roam-back.” • Pre-authentication or “fast-associate in advance” enables an 802.11 AP associated to a client to bridge to other APs over the wired network and pre-authenticate the client to the “next” AP to which the client might roam. This enables the PMK to be derived in advance of a roam and cached. When the client does roam, it will already have negotiated authentication in advance and will use its cached PMK to quickly associate to the next AP. This capability will ensure that wireless clients that support Pre-authentication to continue the data transfer without noticeable connection issues.

It' s not clear to me - does this mean that Fast Roaming only works when using WPA/2 Enterprise?

[Mike_FTNT]

You are right. PMK Caching and Pre-authentication are concerned with IEEE 802.1X authentication. The so called " WPA/WPA2 Enterprise" can support IEEE 802.1X auth .

[srappaport]

Thanks for confirming. So, what is the [best] solution for a more public/hotspot type of environment with multiple FortiAPs controlled by a FortiGate? WPA2 Personal is set up, but Enterprise (or any further authentication) is not wanted as this is a more public type of wifi offering. Any input appreciated.

[veechee]

How fast does it need to be? I' ve installed 4 (non-Fortinet) APs with WPA2 Personal PSK for a public access installation, and I was able to start streaming a video, and I could walk throughout the entire building and it wouldn' t skip. I realize a video stream buffers, but as long as your OS can find the next APs fairly quickly, it should work okay.

[srappaport]

How fast does it need to be?

I guess my reply would be, " How fast can it be?" I have the place set up now so that the 2 FortiAP 222B' s are set up with the same SSID and PSK, so the transition from one AP to the other is already fast enough I think. I just want to make it as good as it can be. This sort of leads me to another question, and I can' t find anything in the documentation, but I was wondering if the controller has any intelligence in doing AP load balance. For instance, a wireless client has decent or equal signal to both APs, but 1 AP has 3x the number of clients currently using it, so it would be better if the client could use the other AP. I wasn' t sure if there was any protocol that assists in balancing like this since the client side needs to be smart enough as well.

[Mike_FTNT]

IEEE 802.1X auth requires extra " Upper Layer" interactions with other auth sever. Without PMK Caching and pre-authentication, client will certainly encounter connection disruption before the whole authentication can be completed. That' s why Fast Roaming is good for WPA Enterprise wifi client . While, as for WPA personal (pre-shared key), wifi client can be directly authenticated by AP at layer 2, so the authentication is as quick as it can be. :) FOS v5.0 (now beta phrase) has load balance feature, though CLI-only in wtp-profile and documentation not ready yet.

[srappaport]

Good info. Thanks guys!