Juniper Mist – 802.11r Support

IEEE 802.11r-2008 is an amendment to the 802.11 standard that allows clients to roam without having to go through the full re-authentication. Premise of this write up is not an introduction/deep dive into 802.11r but to test and better understand how Juniper Mist WLAN implements it and how the Adaptive aka Hybrid, Mixed approach works. If you want to read up more about 802.11r here are some resources I can recommend:

• Wiki – IEEE 802.11r-2008
• CWNP – CWAP and CWSP courses
• Wireless Security Architecture and Maintaining Enterprise Networks by Jennifer Minella
• IEEE 802.11r

There are three ways this gets implemented:

• 802.11r Mode only – Clients that support 802.11r can connect and benefit from it. AKM Key Management only shows FT. Clients that can’t support 802.11r are unable to connect.
• Adaptive Mode – This mode hides the FT in the AKM Key but if a client that does support it connects they will be able to benefit from it.
• Mixed/Hybrid Mode – In this mode two AKM Key Management will show up FT and non-FT. Clients that support it will use the FT method, client that can’t support it will use the non-FT method.

There’s been some really good articles on this subject so I do not want to dig to much into, but I’d like to share/recommend that you do read these blog posts:

• Cisco’s Adaptive 11r (Thanks Brian Powers for recommending this)
• Fast Secure Roaming Overview – Gjermund Raaen

Test Setup:

• Wi-Fi Explorer 3
• Macbook Air
• Mist AP43
• SSIDs
  • mDNS-Test (WPA3/SAE) – 802.11r (Zerbra Compatibility)
  • 80211r (WPA3/SAE) – 802.11r
  • Mist-TLS (WPA3/Enterprise) – 802.11r
  • mspw (WPA3/SAE) – No 802.11r

Test 1 – mDNS-Test:

First SSID setup looked something like this.

This screen shot from Wi-Fi Explorer 3 shows the Mobility Domain and RSNE information, it also shows two different AKM Management Suites showing the Mixed mode of 802.11r mentioned earlier. There is an option to enable “Zebra Compatibility” and from what I can tell it makes the “FT Capability and Policy to use Over-the-DS Fast BSS Transition”.

Test 2 – 80211r:

Almost the same as the previous one. In this case I did turn off the “Zebra Compatibility” though.

This screen shot from Wi-Fi Explorer 3 shows the Mobility Domain and RSNE information, it also shows two different AKM Management Suites showing the Mixed mode of 802.11r mentioned earlier. Since I do not have the “Zebra Compatibility” on, I do not see the “Over-the-DS Fast BSS Transtition”. It is now showing “Over-the Air Fast BSS Transition”. However, I need to confirm what is that value of “0” representing in the capture.

Test 3 – Mist-TLS:

This SSID is setup with WPA3/Enterprise and I wanted to see what the behavior looks like with the 802.1X Authentication.

This screen shot from Wi-Fi Explorer 3 shows the Mobility Domain and RSNE information for a WPA3/Enterprise SSID, it also shows two different AKM Management Suites showing the Mixed mode of 802.11r mentioned earlier. No “Zebra Compatibility” on, I do not see the “Over-the-DS Fast BSS Transtition”. It is showing “Over-the Air Fast BSS Transition”.

Test 4 – mspw:

This SSID is not using 802.11r, instead I am using the Default Juniper Mist behavior (*** UPDATE: Default behavior is PMK Caching aka fast roaming back).

This screen shot from Wi-Fi Explorer 3 shows that there is no Mobility Domain and RSNE information for this SSID, it also shows only one AKM Management Suites.

What about WPA2:

Quick note as this question came up. WPA2 SSID displays the same behavior.

Summary:

After all this, as far as I can tell Mist supports the Hybrid/Mixed mode of the 802.11r, which basically includes two different AKM Suites, one for the clients that support 802.11r and one can be used by the the clients that do not support 802.11r.

Keep in mind that lots of all this will also depend on your clients, how old are they, their capabilities and drivers etc. Know your clients and their capabilities and TEST before turning features on and/or off.