Fast Roaming Compared: 802.1X, PMKSA, OKC and FT
Run the same Wi-Fi roam as a full 802.1X login, PMKSA caching, OKC and FT (802.11r). See the frames, how long each cuts the client off, which method your client and network use, and where the keys are kept.
How to use this tool controls and what to look for
Set up the network and the client, then compare the same roam done four ways: full login, PMKSA caching, OKC and FT.
Controls to change
- Security: choose WPA2-Personal (PSK), WPA3-Personal (SAE), Enterprise with PEAP, or Enterprise with EAP-TLS.
- The roam: roam to a new AP (AP2), back to AP1 (used before), or to an AP on another controller.
- RADIUS round trip: move the RADIUS server further away.
- PMKSA caching: turn each method on or off on the network, along with OKC, FT (802.11r) and 802.11k neighbour reports.
- Client: pick a modern phone, a Windows laptop or an older scanner, each with its own support.
- FT mode: for FT, choose Over the air or Over the DS, and where the PMK-R0 is held.
What to look for
- A full 802.1X login on every roam can take hundreds of milliseconds, and a distant RADIUS server makes it worse.
- PMKSA caching only helps when returning to an AP the client has used before.
- OKC is normally used only with 802.1X. With PSK there is no login to skip.
- FT prepares a PMK-R1 for every AP in advance, so the roam takes four frames with no 4-way handshake.
About this tool
When a Wi-Fi client moves to another access point it has to authenticate and agree new keys before data can flow again. This tool runs the same roam as a full 802.1X or SAE login, PMKSA caching, opportunistic key caching (OKC) and Fast BSS Transition (FT, 802.11r), shows the frames and the time each one takes, works out which method a given client and network actually use, and shows where the keys that make fast roaming possible are kept.
What you'll learn
- Why a full 802.1X login on every roam can take hundreds of milliseconds, and why the RADIUS server's distance matters
- What PMKSA caching, OKC and FT each skip, and which of them work for PSK, SAE and 802.1X networks
- What a PMKID is, and why PMKSA caching only works when returning to an AP the client has used before
- How FT prepares a PMK-R1 for every AP in the mobility domain, so a roam takes four frames with no 4-way handshake
Common questions
What is the fastest way to roam in Wi-Fi?
Fast BSS Transition (FT, 802.11r). The new AP already holds a key made for it, so the roam takes an FT authentication exchange and a reassociation: four frames, with no 802.1X login and no 4-way handshake. It needs FT on the network and the client, and works only between APs in the same mobility domain.
What is the difference between PMKSA caching and OKC?
PMKSA caching reuses the key from an earlier login to the same AP, so it only helps when a client returns to an AP it used before. OKC (opportunistic key caching) has the controller copy the client's key to all its APs, so it works for any AP of that controller. PMKSA caching is in the IEEE 802.11 standard; OKC is a vendor feature.
Do I need fast roaming on a WPA2-Personal network?
Less than on an Enterprise network. With a pre-shared key every AP already has the PMK, so a roam is only authentication, reassociation and the 4-way handshake. FT-PSK still saves the handshake, which helps voice devices.
Free for private and educational use. This interactive model is a simplified teaching aid and may contain mistakes. It is provided as is, without warranty. Use it to understand the concepts, not as a substitute for a site survey, vendor documentation or professional design advice.