Catalyst 9410 and Cisco Meraki Roaming

[tduff4785]

We are running Cisco Meraki APs that are connected to a Catalyst 9410 switch and are experiencing and issue with roaming. We put in the 9410 switch last week replacing a 4510. We did not have this issue when the same Meraki APs were connected to the 4510 and the 9410 has the same port config that the 4510. The Meraki dashboard is just showing Bad Roams or Suboptimal Roams, no other information is given.   Curious if anyone else has come across this issue or something similar in the past, if so what was the solution if there was one.  

[alemabrahao]

Can you provide more information? What type of authentication? Apart from the port configurations, are the other configurations of the 4500 and 9400 the same?

Do you have any topology to share with us?

[PhilipDAth]

Can you show a sample configuration of a port that connects to an AP?

This often means the APs can not communicate with each other using their LAN ports.  Is the management interface of all the APs in the same VLAN?

[GIdenJoe]

Bad roams or suboptimal roams usually has to do with the client choosing the wrong AP to roam to.

In the roaming analytics you should see the RSSI of the previous AP and the next AP.  If the next AP has the same or lower RSSI than the old one the roam is suboptimal or bad.  If that is the case your issue is wireless design, not wired network.  The roaming analytics feature is quite new so you may not have had these messages before.

[tduff4785]

We found the issue, it was related to the config on the new 9400 switch and using 802.1x authentication. We had to add auth mac-move permit to the config. This was something that was enabled by default on the 4500s but not on 9400s.

[GIdenJoe]

Oh really?  So you had your client going back to the original AP just to regain it's connectivity?

[tduff4785]

If we went back to the original AP it would connect right away, if not it would take 3 minutes to join the new AP. Our port authentication timer inactivity config is set to 3 minutes. 

[GIdenJoe]

That makes perfect sense now 😉