Staff roam between two buildings, each with its own Catalyst 9800, and their phones get a new address every time, which drops the call. The SSID and security match. Mobility is not configured between the controllers. What is missing?
Select an answer to reveal the explanation.
Short Explanation
The phone is being treated as a brand-new client at the second building, so it gets a new address and the call dies. Your controllers are not in a mobility relationship, so nobody is anchoring that roam. A second passphrase makes the break worse.
Full Explanation
When two controllers have a mobility relationship, a client can roam between them and keep its address, with the original controller anchoring the session if the roam is Layer 3. These buildings have matching SSID and security and no mobility configured, so each roam looks like a fresh join, DHCP runs again, and the call drops. The missing piece is that mobility relationship. A hidden SSID does not preserve an IP address across controllers. It only changes beacon behavior, and the phones would still be new clients on the second controller. A unique passphrase per building would stop a seamless roam entirely, because the security context would not match. It does not anchor anything. Monitor mode does not serve clients and does not share address state between controllers. Putting both buildings in monitor mode would remove the WLAN. Exam caveat: mobility also requires the controllers to reach each other and to agree on the mobility group. An ACL between the controllers that blocks that path looks like mobility was never configured. Operational check: configure mobility, roam a test phone between buildings, and confirm the address stays the same and the call survives.