We turned on 802.11r and broke a third of our clients

802.11r — Fast BSS Transition — cuts the time a client spends re-authenticating when it roams. It is a good feature and you should use it.

It is also the feature most likely to expose the fact that your client estate is more diverse than your asset register says.

What went wrong

An organisation enabled FT across all SSIDs in a single change window, on the reasonable basis that the standard is fifteen years old and their controller enabled it with one checkbox.

By 09:30 the next morning: a fleet of handheld barcode scanners could not associate at all. A brand of IP phone associated and then dropped every few minutes. Several older laptops connected fine but roamed more slowly than before.

The clients that broke were, predictably, the ones nobody had tested.

The three modes, and why over-the-DS is the trap

• FT over-the-air — the client talks directly to the target AP before roaming. Widely supported and the safer default.
• FT over-the-DS — the client talks to the target AP through its current AP. More efficient in theory, materially less well supported in practice.
• Adaptive / mixed modes — advertise FT only to clients that indicate support. Where this exists it is the sensible starting point, though some clients claim support they do not have.

Most FT problems in the field trace back to over-the-DS.

How to roll it out properly

1. Inventory clients by 802.11 capability, not asset tag. Pull association data and list distinct OUIs and capability flags. The list is always older than expected.
2. Build a test SSID on production infrastructure, so you are testing real RF.
3. Test the awkward devices first. Barcode scanners, IP phones, medical telemetry, badge readers, printers.
4. Enable over-the-air first. Consider over-the-DS only after that is stable.
5. Roll out by SSID, not globally. Corporate laptops first, then voice, then IoT last or never.
6. Keep a fallback SSID without FT. It is inelegant and better than a broken warehouse.

The general lesson

Every roaming feature is a negotiation with client firmware you do not control and cannot patch. Enable them one at a time, on one SSID at a time, with a way to roll back, and with the least fashionable devices in your estate as the test set.

We made exactly this mistake at a law firm — tested on current handsets, broke the 2019 ones. It is never the laptops.