Layer-3 roaming can happen when a client is roaming among APs with the same SSID configured in following 2 scenarios:
Inter-gateway layer-3 roaming.
This is the normal user case, AP A and B is separated by a layer-3 router, when a client roams from A to B, if configured to do so, layer-3 roaming will happen, so that a GRE tunnel will build up from B back to A for back-hauling clientâ€™s traffic without ip-address changed required.
Intra-gateway layer-3 roaming.
Some networks may have the following deployment; 2 APs plugged into the same switch butÂ they will assign different vlans when client associate to the same SSID (through assignment rules). In this case, when a client roams,Â even though theÂ 2 APs are plugged into same layer-2 broadcast domain, layer-3 roaming still need to happen to provide the client a non-interrupted IP connectionÂ (Without the client being issued a new IP address), if the AP is configured to do so.
In both scenarios, whether or not layer-3 roaming will happen is independent of the APâ€™s mgt ip-address assignment.Â Itâ€™s decided if the client will be assigned to the same vlan or not.
Layer-3 roaming may occur only when the â€œhome APâ€� is configured to do so. A â€œhome APâ€� is the first AP in the WiFi network a client associates to in a hive.
After the client is associated to its â€œhome-APâ€�, the clientâ€™s dnxp (Dynamic Network Extension Protocol) cache information will be propagated to its immediate radio neighbor (or static neighbor if configured). When this client roams to its neighbor AP, the â€œroam-toâ€� AP will check the clientâ€™s mac-addr against the dnxp cache to decide if a layer-3 roaming tunnel should be built for this client. Then the â€œroam-toâ€� AP will propagate the roaming cache to its neighbors as well. If the client moves further away from the â€œhome-APâ€�, similar logic happens at the new â€œroam-toâ€� AP.
When a layer-3 roaming tunnel is first setup, the tunnel end point will be selected as one of the portal APs in the clientâ€™s home-LAN.Â Typically the DA (Designated AP) will select the least busy AP. The dnxp-cache will have the layer-3 tunnel information as well as the clientâ€™s original VLAN information. Once a tunnel has been built, if a client keeps roaming further from the â€œhome-APâ€�, the tunnel will try to keep the same end point; unless itâ€™s the â€œhome-APâ€� maximum tunnel capacity is reached. If this occurs, then a new tunnel end point will be selected using the same logic as when tunnel first was established. Should the client keep roaming into other subnet, the layer3-roaming will continue to occur until this client roams back to an AP in its home-LAN. When this occurs, the client is assigned the same VLAN as the clientâ€™s original vlan in dnxp-cache, and layer-3 roaming will stop.