Cisco 8821 Manual page 39

Over the Air
The client communicates directly with the target access point using 802.11 authentication with the FT authentication
algorithm.
Over the Distribution
The client communicates with the target access point through the current access point. The communication between
the client and the target access point is carried in FT action frames between the client and the current access point via
the WLAN controller.
802.11r (FT) utilizing the Over the Air method is the recommended fast secure roaming model to deploy.
Since the 802.11r (FT) plus Over the Distribution method requires connectivity to the currently associated access point, this
method may not work well if the phone is not always able to communicate with the current access point as well as the target
access point, which could occur in non-open environments if line of sight to both the current access point and the target access
point can not be retained when a roaming event occurs.
The Cisco Wireless IP Phone 8821 and 8821-EX support 802.11r (FT) with WPA2-PSK or WPA2 and CCKM with WPA2 or
WPA.
FSR Type
802.11r (FT)
802.11r (FT)
802.11r (FT)
802.11r (FT)
802.11r (FT)
CCKM
CCKM
CCKM
CCKM
Note: If deploying the Cisco Wireless IP Phone 8821 or 8821-EX into an environment where other Wi-Fi phone models exist
but those Wi-Fi phone models do not support 802.11r (FT), then should be able to use that same pre-existing SSID for the Cisco
Wireless IP Phone 8821 or 8821-EX, but is recommended to enable 802.11r (FT) utilizing the Over the Air method on top of
the other pre-existing key management types (e.g. 802.1x, CCKM, or 802.1x + CCKM); assuming the other Wi-Fi phone
models can interoperate in an 802.11r (FT) enabled network while not utilizing 802.11r (FT).
The access point must support AES as TKIP can only be used as the broadcast/multicast cipher.
Cisco Wireless IP Phone 8821 and 8821-EX Wireless LAN Deployment Guide
Authentication Key Management
PSK WPA2
EAP-FAST WPA2
EAP-TLS WPA2
PEAP-GTC WPA2
PEAP-MSCHAPv2 WPA2
EAP-FAST WPA2, WPA
EAP-TLS WPA2, WPA
PEAP-GTC WPA2, WPA
PEAP-MSCHAPv2 WPA2, WPA
Encryption
AES
AES
AES
AES
AES
AES, TKIP
AES, TKIP
AES, TKIP
AES, TKIP
39