What is the correct order of operation for key management service for a wireless client roaming from AP1 to AP2?

What is the correct order of operation for key management service for a wireless client roaming from AP1 to AP2?

• A. Client associates and authenticates to AP1; Get AP1 neighbor AP list; Generate PMK keys for AP1's neighbors; Cache the client's information; Share PMK with target APs along with VLAN and User Role to target APs
• B. Client associates and authenticates to AP1; Cache the client's information; Generate PMK keys for AP1's neighbors; Get AP1 neighbor AP list; Share PMK with target APs along with VLAN and User Role to target APs
• C. Cache the client's information; Client associates and authenticates to AP1; Get AP1 neighbor AP list; Generate PMK keys for AP1's neighbors; Share PMK with target APs along with VLAN and User Role to target APs
• D. Client associates and authenticates to AP1; Get AP1 neighbor AP list; Cache the client's information; Generate PMK keys for AP1's neighbors; Share PMK with target APs along with VLAN and User Role to target APs

Answer: (B)

Fast roaming relies on PMK caching and sharing the client’s PMK with neighboring APs so the next AP can complete authentication without a full re-auth. After the client first connects to AP1 and authenticates, AP1 caches the client’s session information. This keeps the roaming context handy and allows quick use of the PMK when the client moves. AP1 then prepares PMK material for the APs that could serve the client next. Knowing the neighbor APs in the same mobility domain, AP1 identifies which targets will need the PMK. With the neighbor list established, AP1 distributes the PMK to those target APs along with the VLAN and user role so the roaming client lands in the correct network segment and policy on the new AP. This order ensures the roaming path is ready in advance: the session is cached, PMKs are prepared for neighbors, the actual neighbor APs are identified, and the PMKs (plus VLAN and role) are pushed to the appropriate APs for a seamless handoff. Other sequences would delay or misalign the PMK distribution and policy during roaming.

Fast roaming relies on PMK caching and sharing the client’s PMK with neighboring APs so the next AP can complete authentication without a full re-auth.

After the client first connects to AP1 and authenticates, AP1 caches the client’s session information. This keeps the roaming context handy and allows quick use of the PMK when the client moves. AP1 then prepares PMK material for the APs that could serve the client next. Knowing the neighbor APs in the same mobility domain, AP1 identifies which targets will need the PMK. With the neighbor list established, AP1 distributes the PMK to those target APs along with the VLAN and user role so the roaming client lands in the correct network segment and policy on the new AP.

This order ensures the roaming path is ready in advance: the session is cached, PMKs are prepared for neighbors, the actual neighbor APs are identified, and the PMKs (plus VLAN and role) are pushed to the appropriate APs for a seamless handoff. Other sequences would delay or misalign the PMK distribution and policy during roaming.