The Roaming Problem
When you walk through your home carrying a phone, that phone needs to periodically switch from one Wi-Fi access point to a closer one. Without any roaming optimization, this transition involves a complete re-authentication: the device scans for available networks, selects the best access point, and performs a full WPA2 or WPA3 handshake — including generating fresh session keys and completing multiple round trips of cryptographic negotiation. This process typically takes between 50 and 200 milliseconds.
For web browsing and file downloads, 200 milliseconds of interruption is barely noticeable. For a VoIP call or video call, it produces a perceptible glitch or dropout. For applications that depend on millisecond-level timing — gaming, real-time collaboration, wireless medical monitoring — it can cause outright failures. 802.11r was designed specifically to solve this by pre-caching the security material so that the roaming itself takes almost no time.
How 802.11r Works: Key Hierarchies and Pre-Authentication
In a standard WPA2/WPA3 network with multiple access points sharing the same SSID, all APs share the same pre-shared key or 802.1X authentication server. However, each time a device roams to a new AP, it must re-derive fresh session keys and complete a 4-way handshake with the new AP — even though it already proved its identity to the network when it first connected.
802.11r introduces a key hierarchy that separates the long-term network credential (the MSK from 802.1X or PSK) from the per-AP keys used for session encryption. A root key (R0KH) is derived from the credential and stored at a central controller or on all APs in the mobility domain. Each AP then derives a per-AP key (R1KH) from the root key. When a device is connected to AP-A and wants to roam to AP-B, AP-B already has its R1KH available. The device can complete a Fast BSS Transition using only two frames instead of the four-way handshake, because the necessary key material was pre-distributed.
Over-the-Air vs Over-the-DS
802.11r supports two modes for how the pre-authentication exchange is conducted. In over-the-air (OTA) mode, the device communicates directly with the target AP before associating with it — sending FT Authentication Request and Response frames directly to the target AP while still connected to the current AP. This works when the target AP's signal is strong enough for the device to communicate with it directly.
In over-the-DS (Distribution System) mode, the pre-authentication exchange is relayed through the current AP's wired backhaul connection to the target AP. The device sends an FT Action frame to its current AP, which forwards it over the wired network to the target AP, and the target AP's response comes back the same way. Over-the-DS is more reliable in environments where the device cannot yet reach the target AP directly — for example, when the device is at the very edge of AP-A's coverage but not yet close enough to AP-B to directly communicate.
The Roaming Triad: 802.11r, k, and v
802.11r solves the "transition is too slow" problem, but it does not solve the related problems of when to roam and where to roam to. Those are handled by two companion standards that work alongside 802.11r in a complete roaming system.
802.11k (Radio Resource Management) provides the device with a neighbor report — a list of nearby APs in the same mobility domain, including their channel, signal strength, and load. When a device running 802.11k decides it should roam, it already knows which APs are available and can make an informed decision about the best target, rather than having to scan all channels to find alternatives. This reduces the scanning time that often precedes the handoff.
802.11v (BSS Transition Management) gives the current AP the ability to initiate a roam suggestion or request. Instead of waiting for the device to notice that its signal is degrading and decide to roam on its own, the current AP can proactively send a BSS Transition Management Request telling the device that a better AP is available. Combined with the neighbor report from 802.11k, this creates a system where the infrastructure guides the device to move before its connection quality deteriorates significantly.
802.11r Roaming Standards Comparison
| Standard | What it does | Who benefits most |
|---|---|---|
| 802.11r (Fast BSS Transition) | Pre-caches keys; reduces handoff to 1–10 ms | VoIP, video calls, real-time gaming |
| 802.11k (Radio Resource Mgmt) | Provides neighbor report so device knows where to roam | All mobile devices — reduces scan time |
| 802.11v (BSS Transition Mgmt) | AP suggests or requests that device move to better AP | Devices that roam too late (sticky clients) |
| All three combined | Proactive, fast, informed handoff | Enterprise deployments, mesh networks, dense multi-AP homes |
Sticky Client Problem and 802.11v
One of the most common roaming complaints in multi-AP setups is the "sticky client" problem: a device that clings to a distant access point even after walking within range of a closer, stronger one. This happens because Wi-Fi clients are conservative about switching — they only initiate a scan when their current signal drops below a device-specific threshold, which is often set quite low (–75 dBm or lower). By the time the phone finally roams, its connection has been degrading for seconds or minutes.
802.11v addresses this by allowing the AP to push a BSS Transition Management Request before the client's signal degrades badly. The AP can include a list of candidate APs from the 802.11k neighbor report and signal urgency in the request. Well-behaved clients respond by roaming immediately. Some clients ignore the request or negotiate a delay — the standard permits this, which is why 802.11v alone does not guarantee fast roaming. The combination of v (for timely decisions) and r (for fast execution) produces the best outcome.
Should You Enable 802.11r?
For multi-node mesh systems from major vendors, 802.11r and its companions are typically enabled automatically and not exposed as user settings. The mesh firmware handles all fast roaming internally. For deployments with multiple standalone APs (UniFi, Aruba, OpenWRT), enabling all three standards — r, k, and v — is strongly recommended. On consumer routers with a single AP, 802.11r is irrelevant because there is no AP-to-AP handoff to optimize.
The main caveat is that a small number of older devices have buggy 802.11r implementations that cause connection failures. If you enable 802.11r and a specific device stops connecting, try switching to over-the-DS mode, or disable 802.11r for that SSID and add a separate SSID without 802.11r for legacy devices.
Frequently Asked Questions
What is the difference between 802.11r, 802.11k, and 802.11v?
802.11r (Fast BSS Transition) speeds up re-authentication when a device moves to a new access point by caching security keys in advance. 802.11k (Radio Resource Management) helps the device find the best AP to roam to by providing a neighbor report listing nearby APs. 802.11v (BSS Transition Management) allows the current AP to actively suggest that the device move to a better AP. Together: k finds the best candidate, v nudges the device to move, and r makes the move fast.
Does 802.11r break any devices?
Yes, a small number of older devices have buggy 802.11r implementations that cause connection failures when 802.11r is enabled. Most modern devices — Apple, Samsung, current laptops — work correctly. The most commonly reported incompatible devices are some older Android phones, certain IoT devices, and Wi-Fi printers with outdated firmware. If a specific device stops connecting, try over-the-DS mode or disable 802.11r for that SSID.
How much does 802.11r reduce roaming time?
Without 802.11r, roaming between access points typically takes 50–200 milliseconds while the device re-authenticates. With 802.11r, this drops to roughly 1–10 milliseconds — fast enough that active VoIP calls and video calls experience no audible or visible interruption. The human perception threshold for audio discontinuity is around 30 milliseconds, so 802.11r handoffs are effectively imperceptible.
Do I need 802.11r for a mesh Wi-Fi system?
Modern mesh systems implement fast roaming internally as part of their proprietary mesh protocol, often without exposing 802.11r as a user-configurable setting. If you are using a mesh system with a single SSID, fast roaming is likely already enabled and working transparently. 802.11r configuration is most relevant for enterprise setups with multiple standalone access points.
What is pre-authentication in the context of 802.11r?
802.11r uses Fast BSS Transition where the device establishes security keys with nearby access points before it needs to roam to them. The device communicates with the target AP through the current AP (over-the-DS) or directly (over-the-air) before making the move. When the device finally associates with the target AP, the security handshake has already been completed, so the transition reduces to a simple reassociation request rather than a full re-authentication.
Should I enable 802.11r at home?
If you have a multi-node mesh system, 802.11r is either already enabled internally or handled by proprietary roaming logic. If you have multiple standalone access points with the same SSID, enabling 802.11r alongside 802.11k and 802.11v significantly improves roaming quality for mobile devices, VoIP phones, and laptops. If you have a single router, 802.11r is irrelevant since there is no AP-to-AP handoff to optimize.