802.11r Fast Transition on guest networks
802.11r, Fast Transition, speeds up roaming by letting a device pre-authenticate with the access points it is about to move to. On a controlled enterprise network carrying voice and video that is worth having. On a guest network it is usually the wrong trade.
The reason is the device population. A guest SSID serves whatever walks in: older Android handsets, iOS devices several versions behind, and IoT equipment that was cheap when it was new. Fast Transition assumes clients implement it correctly, and a meaningful share of them do not.
What it looks like when it goes wrong
Section titled “What it looks like when it goes wrong”- Android devices fail to associate, or hang partway through association.
- A device connects and is dropped again immediately.
- Authentication loops without ever completing, most often on open or web-authenticated SSIDs.
- A device falls back to 802.11b/g rates, or shows an authentication error with no obvious cause.
These are reported as intermittent and device-specific, which is what makes them expensive to diagnose. The same phone works on the office SSID and fails on the guest SSID in the same building.
Why it happens
Section titled “Why it happens”- Some clients implement 802.11r incorrectly, or do not recognise Fast Transition at all.
- Guest networks generally use open or web-authenticated security rather than the WPA2-Enterprise setup that Fast Transition was designed around.
- Support varies so widely between device types that the SSID behaves inconsistently from one guest to the next.
- Older clients ignore the FT information elements and then fail to complete the association they have already started.
Recommendation
Section titled “Recommendation”Disable 802.11r on guest and public SSIDs unless the client environment is genuinely controlled. Enable it on the internal WPA2-Enterprise or WPA3-Enterprise networks where the benefit is real and the devices are known.
The cost of disabling it on a guest network is slightly slower roaming between access points. The cost of leaving it on is a proportion of guests who cannot get online at all, and a support case that is hard to attribute.