AN13888

802.11r Roaming with Fast Transition (FT)Rev. 2 — 1 July 2024

Application note

Document information
Information

Content

Keywords

802.11r, roaming, bgscan, wpa_supplicant, fast transition

Abstract

Introduces the types of fast transition and describes how to enable fast transition.

AN13888

NXP Semiconductors

802.11r Roaming with Fast Transition (FT)

1 Introduction
NXP Wi-Fi radios support IEEE 802.11r roaming implemented with Fast Transition (FT). Fast Transition is fasterthan normal roaming because it avoids a 4-way handshake when transitioning from one AP to another. This
documents explains how to enable the two types of fast transition.

1.1 Supported products
The following wireless SoCs support 802.11r:• 88W8897• 88W8987• 88W8997• 88W9098• IW416• IW611• IW612
Note: Refer to the feature list in the respective product software release package to check that 802.11r is
supported.

1.2 References
Table 1. Reference list
Reference type

Description

Web pageOpen source wpa_supplicant (link)

Application note

AN13296 - Embedded Wi-Fi Subsystem API specification v16 (link)

Application note

AN13297 - Embedded Wi-Fi Subsystem API specification v17 (link)

Application note

AN13538 - Embedded Wi-Fi Subsystem API specification v18 (link)

1.3 Notation conventions
This document employs the following notation conventions:• Commands and examples of command outputs are shown in paragraphs with grey background color
This is an example of command• Terms related to commands use a monospace font:– parameter– option– command name• File names, directory names and paths are shown in italics:– <file name>.<extension>– <directory>– path/to/directory/and/file

AN13888

Application note

All information provided in this document is subject to legal disclaimers.

Rev. 2 — 1 July 2024

© 2024 NXP B.V. All rights reserved.

Document feedback
2 / 17

AN13888

NXP Semiconductors

802.11r Roaming with Fast Transition (FT)

2 Configuration
This section describes how to enable the fast transition feature.

2.1 Driver
When loading the drivers, use the following parameters to enable fast transition:
host_mlme=1
cfg80211_wext = 0xf (uAP and STA mask of CFG80211 and WEXT control)

Example of command to load the driver:
insmod mlan.ko
insmod sdxxx.ko fw_name=nxp/<fw_name>.bin cfg80211_wext=0xf auto_ds=2 ps_mode=2
txpwrlimit_cfg=nxp/<power_table>.bin cal_data_cfg=nxp/WlanCalData.conf host_mlme=1
drvdbg=0x20037

Note: Setting dvrdbg = 0x20037 is optional and used to log FT messages on dmesg.

AN13888

Application note

All information provided in this document is subject to legal disclaimers.

Rev. 2 — 1 July 2024

© 2024 NXP B.V. All rights reserved.

Document feedback
3 / 17

AN13888

NXP Semiconductors

802.11r Roaming with Fast Transition (FT)

2.2 wpa_supplicant
Note: wpa_supplicant version 2.7 or above is required for Fast Transition.
Step 1 - Enable IEE80211R parameter in hostap/wpa_supplicant/.config file
CONFIG_IEEE80211R=y

Step 2 - Compile wpa_supplicant.
make

Step 3 - Edit wpa_supplicant.conf file
Example of wpa_supplicant.conf content
ctrl_interface=/var/run/wpa_supplicant
ctrl_interface_group=0
update_config=1
ap_scan=1
network={ssid="TEST_NETWORK"
key_mgmt=FT-PSK<- Fast Transition Key Management
proto=RSN
pairwise=CCMP
group=CCMP
psk="1234567890"
bgscan="simple:30:-75:120"<- Background scan settings• Set key_mgmt parameter to FT-PSK or FT-EAP.
key_mgmt=FT-PSK
key_mgmt=FT-EAP• Set the background scanning parameters, bgscan
bgscan="simple:<short scan interval >:< signal strength threshold>:<long scaninterval>”

Where:
Parameter

Description

Short scan interval

Perform a scan every X seconds when the signal strength is
weaker than the threshold

Signal strength threshold

Signal strength from AP (dBm)Long scan interval

Perform a scan every X seconds when the signal strength ishigher than the threshold

Example:bgscan="simple:30:-75:120"

The example performs a scan every 30 seconds when the signal strength from the current AP is below -75
dBm. If the signal strength is above -75 dBm, the interval is every 120 seconds.
Step 4 - Run wpa_supplicant.
wpa_supplicant -B
AN13888

Application note-Dnl80211 -imlan0 -c/etc/wpa_supplicant.conf
All information provided in this document is subject to legal disclaimers.

Rev. 2 — 1 July 2024

© 2024 NXP B.V. All rights reserved.

Document feedback
4 / 17

AN13888

NXP Semiconductors

802.11r Roaming with Fast Transition (FT)

3 Types of fast transition
The two types of fast transition are over-the-air and over-the-distribution-system (over-the-DS).

3.1 Over-the-air fast transition
In over-the-air fast transition, the STA directly communicates with the target AP using IEEE 802.11 FT-Auth and
FT-(Re)Association during the fast transition association flow.
The capability for fast transition is advertised in the Beacon Mobility Domain Information Element of the AP.
Command to trigger fast transition over-the-air:
wpa_cli -i mlan0 ROAM <MAC address of Target AP >3.2 Over-the-DS fast transition
In over-the-DS fast transition, the STA communicates with the target AP through the current AP. STA sends
IEEE 802.11 FT action frames to the current AP which forwards the frames to the target.
The capability for fast transition is advertised in the Beacon Mobility Domain Information Element of the AP.
Note: Open source wpa_supplicant does not support automatic roaming over-the-DS.
Command to trigger fast transition over-the-DS:
wpa_cli -i mlan0 FT_DS

AN13888

Application note

<MAC address of Target AP >All information provided in this document is subject to legal disclaimers.

Rev. 2 — 1 July 2024

© 2024 NXP B.V. All rights reserved.

Document feedback
5 / 17

AN13888

NXP Semiconductors

802.11r Roaming with Fast Transition (FT)

4 Examples
4.1 Over-the-air fast transition
To test over-the-air fast transition, follow these steps:
Step 1 - Configure the wireless LAN controller for Over-the-Air Fast Transition.
Step 2 - Connect both Access points, AP1 and AP2, to the wireless LAN controller.
Step 3 - Configure the DUT as described in Section 3.1 and 3.2 and connect the DUT to AP1.
Step 4 - Move the DUT closer to AP2 until the signal strength from AP1 is less than the threshold
Step 5 - Check that the sniffer capture has the following Over-the-Air sequence:
1. Authentication
2. Authentication
3. Reassociation request
4. Reassociation response
In this example, the wireless LAN controller is configured for over-the-air fast transition. The STA is connected
to AP1 at location A. As the STA moves closer to AP2 at location B, the receive signal strength from AP1 drops
below the set signal threshold. The STA automatically switches to AP2.
Figure 1 shows an example of over-the-air fast transition set-up. The arrows represents the over-the-air fasttransition sequence:
1. Authentication
2. Authentication
3. Reassociation request
4. Reassociation response

Figure 1. Over-the-air fast transition set-up

AN13888

Application note

All information provided in this document is subject to legal disclaimers.

Rev. 2 — 1 July 2024

© 2024 NXP B.V. All rights reserved.

Document feedback
6 / 17

AN13888

NXP Semiconductors

802.11r Roaming with Fast Transition (FT)
Figure 2 shows a screen capture of Over-the-Air Fast Transition in a packet.
• AP1 MAC address of 08:cc:68:b4:2b:a0• STA MAC address of 00:50:43:22:10:72• AP2 MAC address of 08:cc:68:b4:2f:90

Figure 2. Screen capture of Over-the-Air Fast Transition packet

Example of dmesg log:
wlan: send out FT auth,wait for auth responsewlan : FT response target AP 08:XX:XX:XX:2f:90
wlan: FT auth received
Fast BSS Transition use ft-over-air
wlan: Fast Bss transition to bssid 08:XX:XX:XX:2f:90 successfully

AN13888

Application note

All information provided in this document is subject to legal disclaimers.

Rev. 2 — 1 July 2024

© 2024 NXP B.V. All rights reserved.

Document feedback
7 / 17

AN13888

NXP Semiconductors

802.11r Roaming with Fast Transition (FT)

4.2 Over-the-DS fast transition
To test over-the-DS fast transition, follow these steps:
Step 1 - Configure Wireless LAN Controller for over-the-DS fast transition.
Step 2 - Connect the access points AP1 and AP2 to the Wireless LAN Controller.
Step 3 - Configure the DUT as described in Section 3.1 and 3.2 and connect the DUT to AP1.
Step 4 - Move the DUT closer to AP2, where the signal strength from AP1 is less than the threshold.
Step 5 - Run wpa_cli command to trigger over-the-DS fast transition.
wpa_cli -i mlan0 FT_DS<MAC address of Target AP>

Step 6 - Check that the sniffer capture has the following over-the-DS fast transition sequence:
1. Action frame (fast transfer request)
2. Action frame (Fast Transfer Response)
3. Reassociation request
4. Reassociation response
In this example, the wireless LAN controller is configured for over-the-DS fast transition. The STA is connected
to AP1 at location A. When the STA moves closer to AP2 at location B, the receive signal strength from AP1drops below the set signal threshold. STA is triggered to switch to AP2 when the wpa_cli command is issued(step 5)Figure 3 shows over-the-DS fast transitions. The arrows represent over-the-DS fast transition sequence:
1. Action frame (fast transfer request)
2. Action frame (fast transfer response)
3. Reassociation request
4. Reassociation response

Figure 3. Over-the-DS fast transition set-up

AN13888

Application note

All information provided in this document is subject to legal disclaimers.

Rev. 2 — 1 July 2024

© 2024 NXP B.V. All rights reserved.

Document feedback
8 / 17

AN13888

NXP Semiconductors

802.11r Roaming with Fast Transition (FT)
Figure 4 shows a screen capture of over-the-DS fast transition in a packet with:• AP1 MAC address: 08:cc:68:b4:2b:a0• STA MAC address: 00:50:43:22:10:72• AP2 MAC address: 08:cc:68:b4:2f:90

1
2
3
4

Figure 4. Screen capture of over-the-DS fast transition packet

Example of dmesg log:
wlan: send out FT request,wait for FT responsewlan : FT response target AP 08:XX:XX:XX:2f:90
wlan: received FT response
Fast BSS transition to bssid 08:XX:XX:XX:2f:90 successfully

AN13888

Application note

All information provided in this document is subject to legal disclaimers.

Rev. 2 — 1 July 2024

© 2024 NXP B.V. All rights reserved.

Document feedback
9 / 17

AN13888

NXP Semiconductors

802.11r Roaming with Fast Transition (FT)

5 Fast transition flow
The section includes illustrations of the interaction between wpa_supplicant, the Wi-Fi driver and the firmware.
The wpa_supplicant commands (in upper case) are defined in hostap/src/drivers/nl80211_copy.h file.
For more details about the driver to firmware APIs, refer to Embedded Wi-Fi Subsystem API Specifications(Section 1.2).
Figure 5 shows the flow for over-the-air fast transition.

wpa_supplicant

ROAM <BSSID>
wpa_supplicant_associate

driverfirmware

NL80211_CMD_AUTHENTICATEAUTH frame

AUTH RESPONSE frame
sme_event_auth
EVENT_FT_RESPONSE
sme_associate

NL80211_CMD_ASSOCIATE
HostCmd_CMD_802_11_ASSOCIATE

assoc Resp Received
Update GTX

NL80211_CMD_ASSOCIATE_response

HostCmd_CMD_802_11_ASSOCIATE_response

NL80211_CMD_NEW_KEY

HostCmd_802_11_KEY_MATERIAL

Figure 5. Over-the-air fast transition flow

AN13888

Application note

All information provided in this document is subject to legal disclaimers.

Rev. 2 — 1 July 2024

© 2024 NXP B.V. All rights reserved.

Document feedback
10 / 17

AN13888

NXP Semiconductors

802.11r Roaming with Fast Transition (FT)
Figure 6 shows the flow for over-the-DS fast transition.

driverwpa_supplicant

firmwaresend_ft_action()

FT_DS <BSSID>AUTH frame

AUTH RESPONSE frame
ft_rx_action
PKT/PMK-R1 derived
sme_associate

NL80211_CMD_ASSOCIATE
HostCmd_CMD_802_11_ASSOCIATE

Assoc Resp Received
Update GTX

NL80211_CMD_ASSOCIATE_response

HostCmd_CMD_802_11_ASSOCIATE_response

NL80211_CMD_NEW_KEY

HostCmd_802_11_KEY_MATERIAL

Figure 6. Over-the-DS fast transition flow

AN13888

Application note

All information provided in this document is subject to legal disclaimers.

Rev. 2 — 1 July 2024

© 2024 NXP B.V. All rights reserved.

Document feedback
11 / 17

AN13888

NXP Semiconductors

802.11r Roaming with Fast Transition (FT)

6 Note about the source code in the document
The example code shown in this document has the following copyright and BSD-3-Clause license:
Copyright 2023-2024 NXP Redistribution and use in source and binary forms, with or without modification, arepermitted provided that the following conditions are met:
1. Redistributions of source code must retain the above copyright notice, this list of conditions and thefollowing disclaimer.
2. Redistributions in binary form must reproduce the above copyright notice, this list of conditions and thefollowing disclaimer in the documentation and/or other materials must be provided with the distribution.
3. Neither the name of the copyright holder nor the names of its contributors may be used to endorse or
promote products derived from this software without specific prior written permission.
THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND ANY
EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIESOF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENTSHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT,INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITEDTO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR
BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN
ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCHDAMAGE.

AN13888

Application note

All information provided in this document is subject to legal disclaimers.

Rev. 2 — 1 July 2024

© 2024 NXP B.V. All rights reserved.

Document feedback
12 / 17

AN13888

NXP Semiconductors

802.11r Roaming with Fast Transition (FT)

7 Acronyms and abbreviations
Table 2. Acronyms and abbreviations
AcronymDefinition

AP

Access point

bgscanBackground scan

DS

Distribution system

DUT

Device under test

FT

Fast transition

MLME

Mac layer management entity

RSSI

Receive signal strength indication

STA

Stationwpa_cliCommand line interface to wpa_supplicant

AN13888

Application note

All information provided in this document is subject to legal disclaimers.

Rev. 2 — 1 July 2024

© 2024 NXP B.V. All rights reserved.

Document feedback
13 / 17

AN13888

NXP Semiconductors

802.11r Roaming with Fast Transition (FT)

8 Revision history
Table 3. Revision history
Document ID

Release date

Description

AN13888 v.2

01 July 2024

• Changed the access from confidential to public.

AN13888 v.1

04 August 2023

• Initial version

AN13888

Application note

All information provided in this document is subject to legal disclaimers.

Rev. 2 — 1 July 2024

© 2024 NXP B.V. All rights reserved.

Document feedback
14 / 17

AN13888

NXP Semiconductors

802.11r Roaming with Fast Transition (FT)

Legal information
Definitions
Draft — A draft status on a document indicates that the content is still
under internal review and subject to formal approval, which may resultin modifications or additions. NXP Semiconductors does not give any
representations or warranties as to the accuracy or completeness of
information included in a draft version of a document and shall have noliability for the consequences of use of such information.

Disclaimers
Limited warranty and liability — Information in this document is believed
to be accurate and reliable. However, NXP Semiconductors does not give
any representations or warranties, expressed or implied, as to the accuracy
or completeness of such information and shall have no liability for theconsequences of use of such information. NXP Semiconductors takes noresponsibility for the content in this document if provided by an information
source outside of NXP Semiconductors.
In no event shall NXP Semiconductors be liable for any indirect, incidental,
punitive, special or consequential damages (including - without limitation lost profits, lost savings, business interruption, costs related to the removalor replacement of any products or rework charges) whether or not suchdamages are based on tort (including negligence), warranty, breach ofcontract or any other legal theory.
Notwithstanding any damages that customer might incur for any reason
whatsoever, NXP Semiconductors’ aggregate and cumulative liability
towards customer for the products described herein shall be limited inaccordance with the Terms and conditions of commercial sale of NXP
Semiconductors.
Right to make changes — NXP Semiconductors reserves the right tomake changes to information published in this document, including without
limitation specifications and product descriptions, at any time and without
notice. This document supersedes and replaces all information supplied prior
to the publication hereof.
Applications — Applications that are described herein for any of theseproducts are for illustrative purposes only. NXP Semiconductors makes norepresentation or warranty that such applications will be suitable for the
specified use without further testing or modification.
Customers are responsible for the design and operation of theirapplications and products using NXP Semiconductors products, and NXP
Semiconductors accepts no liability for any assistance with applications or
customer product design. It is customer’s sole responsibility to determine
whether the NXP Semiconductors product is suitable and fit for thecustomer’s applications and products planned, as well as for the planned
application and use of customer’s third party customer(s). Customers should
provide appropriate design and operating safeguards to minimize the risks
associated with their applications and products.
NXP Semiconductors does not accept any liability related to any default,
damage, costs or problem which is based on any weakness or default
in the customer’s applications or products, or the application or use bycustomer’s third party customer(s). Customer is responsible for doing allnecessary testing for the customer’s applications and products using NXP
Semiconductors products in order to avoid a default of the applications
and the products or of the application or use by customer’s third party
customer(s). NXP does not accept any liability in this respect.

Terms and conditions of commercial sale — NXP Semiconductors
products are sold subject to the general terms and conditions of commercial
sale, as published at https://www.nxp.com/profile/terms, unless otherwise
agreed in a valid written individual agreement. In case an individual
agreement is concluded only the terms and conditions of the respective
agreement shall apply. NXP Semiconductors hereby expressly objects toapplying the customer’s general terms and conditions with regard to thepurchase of NXP Semiconductors products by customer.
Suitability for use in automotive applications — This NXP product has
been qualified for use in automotive applications. If this product is usedby customer in the development of, or for incorporation into, products orservices (a) used in safety critical applications or (b) in which failure could
lead to death, personal injury, or severe physical or environmental damage(such products and services hereinafter referred to as “Critical Applications”),
then customer makes the ultimate design decisions regarding its products
and is solely responsible for compliance with all legal, regulatory, safety,
and security related requirements concerning its products, regardless of
any information or support that may be provided by NXP. As such, customer
assumes all risk related to use of any products in Critical Applications and
NXP and its suppliers shall not be liable for any such use by customer.
Accordingly, customer will indemnify and hold NXP harmless from any
claims, liabilities, damages and associated costs and expenses (including
attorneys’ fees) that NXP may incur related to customer’s incorporation of
any product in a Critical Application.
Export control — This document as well as the item(s) described herein
may be subject to export control regulations. Export might require a priorauthorization from competent authorities.
Translations — A non-English (translated) version of a document, including
the legal information in that document, is for reference only. The English
version shall prevail in case of any discrepancy between the translated andEnglish versions.
Security — Customer understands that all NXP products may be subject tounidentified vulnerabilities or may support established security standards or
specifications with known limitations. Customer is responsible for the designand operation of its applications and products throughout their lifecycles
to reduce the effect of these vulnerabilities on customer’s applications
and products. Customer’s responsibility also extends to other open and/or
proprietary technologies supported by NXP products for use in customer’s
applications. NXP accepts no liability for any vulnerability. Customer should
regularly check security updates from NXP and follow up appropriately.
Customer shall select products with security features that best meet rules,
regulations, and standards of the intended application and make theultimate design decisions regarding its products and is solely responsible
for compliance with all legal, regulatory, and security related requirements
concerning its products, regardless of any information or support that may beprovided by NXP.
NXP has a Product Security Incident Response Team (PSIRT) (reachable
at PSIRT@nxp.com) that manages the investigation, reporting, and solution
release to security vulnerabilities of NXP products.
NXP B.V. — NXP B.V. is not an operating company and it does not distributeor sell products.

Trademarks
Notice: All referenced brands, product names, service names, andtrademarks are the property of their respective owners.
NXP — wordmark and logo are trademarks of NXP B.V.

AN13888

Application note

All information provided in this document is subject to legal disclaimers.

Rev. 2 — 1 July 2024

© 2024 NXP B.V. All rights reserved.

Document feedback
15 / 17

AN13888

NXP Semiconductors

802.11r Roaming with Fast Transition (FT)

TablesTab. 1.
Tab. 2.

Reference list .................................................... 2
Acronyms and abbreviations ........................... 13

Tab. 3.

Revision history ...............................................14

Fig. 4.

Screen capture of over-the-DS fasttransition packet ................................................ 9Over-the-air fast transition flow ....................... 10
Over-the-DS fast transition flow ...................... 11

FiguresFig. 1.
Fig. 2.
Fig. 3.

Over-the-air fast transition set-up ......................6
Screen capture of Over-the-Air Fast
Transition packet ............................................... 7
Over-the-DS fast transition set-up .....................8AN13888

Application noteFig. 5.
Fig. 6.

All information provided in this document is subject to legal disclaimers.

Rev. 2 — 1 July 2024

© 2024 NXP B.V. All rights reserved.

Document feedback
16 / 17

AN13888

NXP Semiconductors

802.11r Roaming with Fast Transition (FT)

Contents
1
1.1
1.2
1.3
2
2.1
2.2
3
3.1
3.2
4
4.1
4.2
5
6
7
8

Introduction ...................................................... 2
Supported products ........................................... 2
References .........................................................2
Notation conventions ......................................... 2
Configuration ................................................... 3
Driver ................................................................. 3
wpa_supplicant .................................................. 4
Types of fast transition ................................... 5
Over-the-air fast transition ................................. 5
Over-the-DS fast transition ................................ 5
Examples .......................................................... 6
Over-the-air fast transition ................................. 6
Over-the-DS fast transition ................................ 8
Fast transition flow ........................................10
Note about the source code in the
document ........................................................12
Acronyms and abbreviations ....................... 13
Revision history .............................................14
Legal information ...........................................15

Please be aware that important notices concerning this document and the product(s)described herein, have been included in section 'Legal information'.

© 2024 NXP B.V.
For more information, please visit: https://www.nxp.com

All rights reserved.
Document feedback
Date of release: 1 July 2024
Document identifier: AN13888