Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

CCKM/Fast Roaming CCXv3 and CCXv4 Clients

I am trying to verify for sure if CCXv3 clients can connect to a wlan configured with 802.1X+CCKM, and security WPA2/AES and do fast roaming?

It appears that CCXv3 clients do not support CCKM with 802.1X/EAP TLS.

1 ACCEPTED SOLUTION

Accepted Solutions

Re: CCKM/Fast Roaming CCXv3 and CCXv4 Clients

CCKM was introduced many many years ago. It was Cisco's way to overcome clients having to auth during each roam from ap to ap. This process was very disruptive for sensitive applications.  Apple devices and others still suffer from this. 802.11r (FT) will fix this process as more devices support it.

They are similar in that they both achive faster romaing but via different mechanisms. PMK is supported across different platforms through OKC. While CCKM is exclusive to CCX supported clients and Cisco gear.

The PMK is generated at the radius sever and is sent to the WLC to use as keying material for the the 4 way handshake. I blogged about this here ..

http://www.my80211.com/8021x/2010/10/3/george-stefanick-cwsp-journey-chapter-5-4-way-handshake-post.html

CCKM is generated at the cisco device, after 802.1X process is done. . You can read more about CCKM here ..

https://supportforums.cisco.com/docs/DOC-2068

When you run PMK cache command .. Clients that show PMK means they are using OKC. A client showing CCKM would mean they are using Cisco's flavor.

Does this help ?

__________________________________________________________________________________________
"Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin
__________________________________________________________________________________________
‎"I'm in a serious relationship with my Wi-Fi. You could say we have a connection."

__________________________________________________________________________________________ "Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin ___________________________________________________________
8 REPLIES

CCKM/Fast Roaming CCXv3 and CCXv4 Clients

Correct v4 supports TLS.

Here is the matrix for CCX

http://www.cisco.com/web/partners/pr46/pr147/program_additional_information_new_release_features.html

__________________________________________________________________________________________
"Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin
__________________________________________________________________________________________
‎"I'm in a serious relationship with my Wi-Fi. You could say we have a connection."

__________________________________________________________________________________________ "Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin ___________________________________________________________
New Member

CCKM/Fast Roaming CCXv3 and CCXv4 Clients

Ok, I understand that thanks.  I am somewhat confused as to what the difference is between PMK and CCKM.  If I issue the command show pmk-cache all on my WLC, I see several entries of clients that are CCXv3 configured for 802.1X+CCKM listed as PMK cache entries. 

Is PMK different than CCKM?

Re: CCKM/Fast Roaming CCXv3 and CCXv4 Clients

CCKM was introduced many many years ago. It was Cisco's way to overcome clients having to auth during each roam from ap to ap. This process was very disruptive for sensitive applications.  Apple devices and others still suffer from this. 802.11r (FT) will fix this process as more devices support it.

They are similar in that they both achive faster romaing but via different mechanisms. PMK is supported across different platforms through OKC. While CCKM is exclusive to CCX supported clients and Cisco gear.

The PMK is generated at the radius sever and is sent to the WLC to use as keying material for the the 4 way handshake. I blogged about this here ..

http://www.my80211.com/8021x/2010/10/3/george-stefanick-cwsp-journey-chapter-5-4-way-handshake-post.html

CCKM is generated at the cisco device, after 802.1X process is done. . You can read more about CCKM here ..

https://supportforums.cisco.com/docs/DOC-2068

When you run PMK cache command .. Clients that show PMK means they are using OKC. A client showing CCKM would mean they are using Cisco's flavor.

Does this help ?

__________________________________________________________________________________________
"Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin
__________________________________________________________________________________________
‎"I'm in a serious relationship with my Wi-Fi. You could say we have a connection."

__________________________________________________________________________________________ "Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin ___________________________________________________________
New Member

CCKM/Fast Roaming CCXv3 and CCXv4 Clients

Yes, this does help.  Great explanation, I appreciate that.

Re: CCKM/Fast Roaming CCXv3 and CCXv4 Clients

Keep in mind with 802.1X+CCKM this means 802.1X clients using PMK/OKC or CCKM are supported. I've personally had clients not connect when it was 802.1X+CCKM. I diverted back to just 802.1X, no issues.

Something to keep in mind if you have client connecton issues.

__________________________________________________________________________________________
"Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin
__________________________________________________________________________________________
‎"I'm in a serious relationship with my Wi-Fi. You could say we have a connection."

__________________________________________________________________________________________ "Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin ___________________________________________________________
New Member

CCKM/Fast Roaming CCXv3 and CCXv4 Clients

Yes, this makes sense as that is how we typically configure the WLAN with 802.1X+CCKM.  I do feel better that even though we are not doing CCKM, there is a form of key caching mechanism in place that does help with faster roaming.

Is PMK supported with FlexConnect AP's if those AP's are in a Flexconnect Group?

Thanks for all the extremely helpful information.

CCKM/Fast Roaming CCXv3 and CCXv4 Clients

Keep in mind PMK is specific to an ap and client. If a client roams away from the ap and comes back it doesnt have to reauth becuase it uses the PMK. OKC, uses the orginal PMK generated during your first auth and then shares it with other aps to negate auth .. clients need to support OKC to take full advantage

For flex ..

FlexConnect Groups and CCKM

FlexConnect Groups are required for CCKM fast roaming to work with FlexConnect access points. CCKM fast roaming is achieved by caching a derivative of the master key from a full EAP authentication so that a simple and secure key exchange can occur when a wireless client roams to a different access point. This feature prevents the need to perform a full RADIUS EAP authentication as the client roams from one access point to another. The FlexConnect access points need to obtain the CCKM cache information for all the clients that might associate so they can process it quickly instead of sending it back to the controller. If, for example, you have a controller with 300 access points and 100 clients that might associate, sending the CCKM cache for all 100 clients is not practical. If you create a FlexConnect that includes a limited number of access points (for example, you create a group for four access points in a remote office), the clients roam only among those four access points, and the CCKM cache is distributed among those four access points only when the clients associate to one of them.

Note CCKM fast roaming among FlexConnect and non-FlexConnect access points is not supported. See the "Configuring WPA1 +WPA2" section for information on configuring CCKM.

FlexConnect Groups and Opportunistic Key Caching

Starting in the 7.0.116.0 release, FlexConnect groups enable Opportunistic Key Caching (OKC) to enable fast roaming of clients. OKC facilitates fast roaming by using PMK caching in access points that are in the same FlexConnect group.

This feature prevents the need to perform a full authentication as the client roams from one access point to another. Whenever a client roams from one FlexConnect access point to another, the FlexConnect group access point calculates the PMKID using the cached PMK.

To see the PMK cache entries at the FlexConnect access point, use the show capwap reap pmk command. This feature is supported on Cisco FlexConnect access points.

Note The FlexConnect access point must be in connected mode when the PMK is derived during WPA2/802.1x authentication.

When using FlexConenct groups for OKC or CCKM, the PMK-cache is shared only across the access points that are part of the same FlexConnect group and are associated to the same controller. If the access points are in the same FlexConnect group but are associated to different controllers that are part of the same mobility group, the PMK cache is not updated and CCKM roaming will fail.

__________________________________________________________________________________________
"Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin
__________________________________________________________________________________________
‎"I'm in a serious relationship with my Wi-Fi. You could say we have a connection."

__________________________________________________________________________________________
"Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin
__________________________________________________________________________________________
‎"I'm in a serious relationship with my Wi-Fi. You could say we have a connection."

__________________________________________________________________________________________ "Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin ___________________________________________________________

CCKM/Fast Roaming CCXv3 and CCXv4 Clients

Thanks for rating my post

__________________________________________________________________________________________
"Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin
__________________________________________________________________________________________
‎"I'm in a serious relationship with my Wi-Fi. You could say we have a connection."

__________________________________________________________________________________________ "Satisfaction does not come from knowing the solution, it comes from knowing why." - Rosalind Franklin ___________________________________________________________
2089
Views
0
Helpful
8
Replies
CreatePlease login to create content