Warehouse barcode scanners fail when 802.11r is enabled on the logistics SSID. What is a reasonable secure-roaming response?
Select an answer to reveal the explanation.
Short Explanation
If FT makes scanners trip, do not pave the path with open or WEP. Try OKC where it works, or live with slower full reauth on that SSID. Compatibility is not a blank check to strip security.
Full Explanation
When warehouse barcode scanners fail to operate correctly with 802.11r enabled on a logistics SSID, a practical secure-roaming solution is to employ Opportunistic Key Caching (OKC) if supported, or otherwise accept slower full reauthentication rather than forcing the use of Fast Transition (FT). OKC allows clients to cache Pairwise Master Keys (PMKs) from previous authentications to expedite reconnection without the complexity or compatibility issues of FT. This approach preserves encryption and authentication integrity while accommodating devices that may not fully support 802.11r. Disabling all encryption citywide compromises security and exposes sensitive logistics data. Downgrading scanners to WEP is obsolete and insecure, exposing communications to trivial attacks. Bridging scanners directly to the domain-controller VLAN without authentication bypasses essential access controls and risks unauthorized access. It is important to recognize that some legacy or specialized devices may lack full 802.11r support, necessitating fallback mechanisms like OKC or full reauthentication. Administrators should test scanner behavior with OKC enabled and monitor authentication logs to ensure successful secure connections without forcing incompatible FT usage.