Cisco M10-RM Software Manual page 248

Understanding Fast Secure Roaming
Figure 12-1
Client
device
When you configure your wireless LAN for fast, secure roaming, however, LEAP-enabled client devices
roam from one access point to another without involving the main RADIUS server. Using Cisco
Centralized Key Management (CCKM), a device configured to provide Wireless Domain Services
(WDS) takes the place of the RADIUS server and authenticates the client so quickly that there is no
perceptible delay in voice or other time-sensitive applications.
using CCKM.
Figure 12-2
Roaming client
The WDS device maintains a cache of credentials for CCKM-capable client devices on your wireless
LAN. When a CCKM-capable client roams from one access point to another, the client sends a
reassociation request to the new access point, and the new access point relays the request to the WDS
Cisco IOS Software Configuration Guide for Cisco Aironet Access Points
12-4
Chapter 12 Configuring WDS, Fast Secure Roaming, Radio Management, and Wireless Intrusion Detection
Client Authentication Using a RADIUS Server
1. Authentication request
2. Identity request
3. Username
(relay to client)
5. Authentication response
(relay to client)
7. Authentication challenge
(relay to client)
9. Successful authentication
Client Reassociation Using CCKM and a WDS Access Point
Access point
device
Reassociation request
Reassociation response
Wired LAN
Access point
or bridge
(relay to server)
4. Authentication challenge
(relay to server)
6. Authentication success
(relay to server)
8. Authentication response
(relay to server)
WDS
Access point or switch
providing Wireless
Domain Services
Pre-registration request
Pre-registration reply
RADIUS Server
Figure 12-2 shows client authentication
Wired LAN
Authentication server
OL-14209-01