# Wireless Clients Seamless Roaming Best Practices **URL:** \ **Category:** Enterprise Wi-Fi Networks\ **Tags:** knowledge-base\ **Created:** [December 20, 2023, 11:54am UTC](https://community.cambiumnetworks.com/t/wireless-clients-seamless-roaming-best-practices/96851 "2023-12-20T11:54:44Z")\ **Posts on this page:** 10\ **Page:** 1
**Author:** ![Sanjay\_Jadhav](https://d10gw3vjmzyp8.cloudfront.net/letter_avatar_proxy/v4/letter/s/8491ac/32.png) [@Sanjay\_Jadhav](https://community.cambiumnetworks.com/u/Sanjay_Jadhav)\ **Post date:** [December 20, 2023, 11:54am UTC](https://community.cambiumnetworks.com/t/wireless-clients-seamless-roaming-best-practices/96851/1 "2023-12-20T11:54:44Z")
# Introduction This document explains Cambium Networks Access Points (APs) and external network recommended configuration to facilitate wireless clients’ seamless roaming across the APs. Additionally, network best practices recommended minimizing broadcast and multicast packets processing in the network. # External network recommendation Cambium Access Points (APs) work in the distributed architecture mode. It is important to facilitate AP to AP communication for the wireless clients seamless roaming. Access Points uses Cambium propriety XRP protocol to exchange client’s information with the neighboring APs. - The intermediate network switches to which APs are connected shall not block XRP messages. - APs send XRP messages on the ethernet port’s native VLAN. - All the APs need to be part of the same native VLAN. - It is important to ensure APs have the L3 interface for the native VLAN with the valid IP address. # Access Point WLAN profile configuration recommendation If WLAN profile is configured with WPA2 and WPA3 security, it is recommended to enable. - 802.11r fast roaming and - OKC Few clients make use of 802.11k and 802.11v protocols for fast roaming, we can enable the same. ![image](https://d1okf4ta8xniw3.cloudfront.net/original/3X/3/e/3efa9ec271fe15b3f97c0daf9e2fdccfd2b60a6c.png) Enable client isolation with the Network Wide option to prevent clients communicating with other clients on the same L2 network. ![image](https://d1okf4ta8xniw3.cloudfront.net/original/3X/6/5/65d1d81d8bcf43c378c8239c567e0a9b37e5f703.png) **Note:** From the AP firmware version 6.6.0.2 onwards, AP drops the ARP packets when the client isolation feature is enabled. AP running with the firmware version lower than 6.6.0.2 can make use of `client-isolation dynamic drop-arp` cli from the AP group User-Defined Overrides section. ![image](https://d1okf4ta8xniw3.cloudfront.net/original/3X/a/b/abe48ebb630c09233d3e258fa60d65c4f6b4fc1b.png) # AP group profile configuration recommendations - To avoid sticky client’s issue, enable Enhanced Roaming under AP group → RADIO configuration, set SNR threshold to 15 dBm - In large public Wi-Fi and campus deployment, it is very common to see large number of network discovery protocols like mDNS, LLMNR, SSDP and other service discovery packets coming from the wireless clients. It is recommended to disable these packets using “Access Control Policy.” - If IPv6 is not the requirement, it is recommended to disable IPv6 packets from the wireless clients using “Access Control Policy.” - It is recommended to use “Air Cleaner Rules.” - To prevent un-authorized rogue DHCP server from the wireless clients. - Unwanted DHCP client packets from wired network side. - Drop L2 broadcast packets. - Drop IPv4 and IPv6 multicast packets. - Drop ARP discovery packets from one SSID to another SSID interface. - It is recommended to disable mDNS packets in the default Air Cleaner rules - Sample AP group policy with the Air Cleaner Rules User-defined rule for blocking IPV6 traffic & allowing rest traffic. ```plaintext ! filter global-filter filter precedence 14 enable layer3-filter deny proto6 any any any any any any //BLOCK IPv6 TRAFFIC exit filter precedence 15 enable layer3-filter permit ip any/any any/any any //ALLOW TRAFFIC exit ! ``` ---
**Author:** ![Alen\_Kocijancic](https://d10gw3vjmzyp8.cloudfront.net/letter_avatar_proxy/v4/letter/a/dfb087/32.png) [@Alen\_Kocijancic](https://community.cambiumnetworks.com/u/Alen_Kocijancic)\ **Post date:** [December 28, 2023, 11:46am UTC](https://community.cambiumnetworks.com/t/wireless-clients-seamless-roaming-best-practices/96851/2 "2023-12-28T11:46:41Z")
Hi, does this recommendation also apply to old models E500, E510, E425, E430H? ---
**Author:** ![cireddy](https://d10gw3vjmzyp8.cloudfront.net/letter_avatar_proxy/v4/letter/c/22d042/32.png) [@cireddy](https://community.cambiumnetworks.com/u/cireddy)\ **Post date:** [January 8, 2024, 4:56am UTC](https://community.cambiumnetworks.com/t/wireless-clients-seamless-roaming-best-practices/96851/3 "2024-01-08T04:56:34Z")
hi alen, applicable for wi-fi 6 aps running with the 6.x images. ---
**Author:** ![Chris\_Porosky](https://d10gw3vjmzyp8.cloudfront.net/letter_avatar_proxy/v4/letter/c/7993a0/32.png) [@Chris\_Porosky](https://community.cambiumnetworks.com/u/Chris_Porosky)\ **Post date:** [April 7, 2024, 2:08pm UTC](https://community.cambiumnetworks.com/t/wireless-clients-seamless-roaming-best-practices/96851/4 "2024-04-07T14:08:47Z")
Where are the air cleaner rules in cnmaestro? ---
**Author:** ![GaryHansen](https://d10gw3vjmzyp8.cloudfront.net/letter_avatar_proxy/v4/letter/g/aca169/32.png) [@GaryHansen](https://community.cambiumnetworks.com/u/GaryHansen)\ **Post date:** [April 7, 2024, 2:42pm UTC](https://community.cambiumnetworks.com/t/wireless-clients-seamless-roaming-best-practices/96851/5 "2024-04-07T14:42:34Z")
Hi @Chris_Porosky and welcome to the community. The Air Cleaner rules are under Wi-Fi Profiles \> Access Control Policies \> AP Group Policy. Once created, add the AP Group Policy that you created to your AP Group under Access Control. ![image](https://d1okf4ta8xniw3.cloudfront.net/original/3X/c/f/cf6f4cff6a96907e9472dae8b9be2df95249734d.png) ![image](https://d1okf4ta8xniw3.cloudfront.net/original/3X/9/5/9535428b1b4b78847c09e3649aa629e52d2442f3.png) ---
**Author:** ![Thomas\_Schmidt](https://d10gw3vjmzyp8.cloudfront.net/letter_avatar_proxy/v4/letter/t/57b2e6/32.png) [@Thomas\_Schmidt](https://community.cambiumnetworks.com/u/Thomas_Schmidt)\ **Post date:** [April 22, 2024, 11:28pm UTC](https://community.cambiumnetworks.com/t/wireless-clients-seamless-roaming-best-practices/96851/6 "2024-04-22T23:28:29Z")
Can you clarify the “Native VLAN” requirement for Over-the-DS of Fast roaming. My AP’s are setup using a Tagged VLAN, the SSID’s are setup with thier own respective Tagged VLAN’s. To have have Over-the-DS to work, do I need to change my AP’s from thier Tagged VLAN to untagged? ---
**Author:** ![Piotr\_Charkiewicz](https://d10gw3vjmzyp8.cloudfront.net/letter_avatar_proxy/v4/letter/p/c5a1d2/32.png) [@Piotr\_Charkiewicz](https://community.cambiumnetworks.com/u/Piotr_Charkiewicz)\ **Post date:** [July 26, 2024, 2:49pm UTC](https://community.cambiumnetworks.com/t/wireless-clients-seamless-roaming-best-practices/96851/7 "2024-07-26T14:49:27Z")
Would that solution work for the clients which are logged in through Captive Portal? As well how to set this solution if you have APs with 6.6 image and 4.2. Kind Regards, Piotr ---
**Author:** ![Edues](https://d10gw3vjmzyp8.cloudfront.net/user_avatar/community.cambiumnetworks.com/edues/32/31153_2.png) [@Edues](https://community.cambiumnetworks.com/u/Edues)\ **Post date:** [October 17, 2024, 1:47pm UTC](https://community.cambiumnetworks.com/t/wireless-clients-seamless-roaming-best-practices/96851/8 "2024-10-17T13:47:35Z")
Does Layer 7 application filtering consume a lot of AP resources? Kind Regards, Edu ---
**Author:** ![Md\_Anwar\_Hossain](https://d10gw3vjmzyp8.cloudfront.net/user_avatar/community.cambiumnetworks.com/md_anwar_hossain/32/31870_2.png) [@Md\_Anwar\_Hossain](https://community.cambiumnetworks.com/u/Md_Anwar_Hossain)\ **Post date:** [July 27, 2026, 3:17pm UTC](https://community.cambiumnetworks.com/t/wireless-clients-seamless-roaming-best-practices/96851/9 "2026-07-27T15:17:27Z")
Hi Sanjay Jadhav, Thank you I have some question for this configuration, could please hlep me to understand this 1. Could you help me to confirm my rules inputs value is correct under IP and Application Filtering Rules, I created one for BLOCK DROPBOX DISCOVERRY 2. **How to prevent un-authorized rogue DHCP server from the wireless clients ?** 3. **How I could drop L2 broadcase packets ?** 4. **How to Drop ARP discovery packets from one SSID to another SSID interface ?** ---
**Author:** ![Sanjay\_Jadhav](https://d10gw3vjmzyp8.cloudfront.net/letter_avatar_proxy/v4/letter/s/8491ac/32.png) [@Sanjay\_Jadhav](https://community.cambiumnetworks.com/u/Sanjay_Jadhav)\ **Post date:** [July 29, 2026, 2:31pm UTC](https://community.cambiumnetworks.com/t/wireless-clients-seamless-roaming-best-practices/96851/10 "2026-07-29T14:31:26Z")
1. The rule is correct. However, please update the destination port from **Any** to **UDP port 17500 over IPv4** , which Dropbox uses for discovery. For reference, see the [Dropbox documentation](https://help.dropbox.com/sync/lan-sync-overview). 2. For questions 2, 3, and 4, the answer is **AIRCLEANER RULES**. ## Creating Air Cleaner Rules & Attaching to AP Groups in cnMaestro **Step-by-step:** 1. Go to **Configuration \> Wi-Fi Profiles \> Access Control Policies** 2. Click **Add AP Group Policy** 3. Enter policy **Name** and select **Managed Account** 4. **Enable Air Cleaner** checkbox 5. Click **Add** after all rules created 6. Go to target **AP Group \> Access Control** tab and link the AP Group policy.