Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.1.x

PDF

Cisco Catalyst 9800 Series Wireless Controller Software Configuration Guide, Cisco IOS XE 26.1.x

Opportunistic key caching

Updated: April 10, 2026

Want to summarize with AI?

Log in

Explains the OKC technique that allows wireless clients and the WLAN infrastructure to cache only one PMK for client association with a WLAN.

Opportunistic Key Caching (OKC) is an enhancement of the WPA2 Pairwise Master Key ID (PMKID) caching method that

  • allows wireless clients and the WLAN infrastructure to cache only one PMK for client association with a WLAN, even when roaming between multiple APs

  • enables APs to share the original PMK that is used for the WPA2 4-way handshake, and

  • works with WPA2-EAP as a fast roaming technique.

Key characteristics

OKC shares several characteristics with PMKID caching:

  • The initial association to an AP is a regular first-time authentication to the corresponding WLAN, where you must complete the entire 802.1X/EAP authentication for the authentication server, and the 4-way handshake for key generation, before sending data frames.

  • All APs share the original PMK from a client session under a centralized device that caches and distributes the original PMK to all the APs.

  • New encryption keys are generated every time a client reassociates with APs.

OKC support varies by client type:

  • Microsoft and some Android clients support OKC.

  • Apple and few Android clients support 802.11r as an alternative fast roaming method.

OKC configuration characteristics:

  • OKC is enabled by default on a WLAN.

  • Disabling OKC on a WLAN disables the OKC even for the OKC-supported clients.

  • A new configuration is introduced for each WLAN in the controller in Cisco IOS XE Amsterdam 17.2.1, to disable or enable fast and secure roaming with OKC at the corresponding AP.

Enable opportunistic key caching

Opportunistic Key Caching (OKC) improves wireless client roaming performance by allowing clients to use cached encryption keys when moving between access points within the same mobility domain.

Use this procedure when you need to enable OKC on a WLAN to enhance client roaming experience. OKC is enabled by default on most configurations.

Procedure

1.

Enter global configuration mode.

Example:

Device# configure terminal
2.

Enter WLAN configuration submode.

Example:

Device(config)# wlan wlan-profile-name wlan-identifier <1-4096> ssid-network-name
Device(config)# wlan wlan-profile-name 18 san-ssid
3.

Enable Opportunistic Key Caching, if not enabled. By default, the OKC feature is enabled.

Example:

Device(config-wlan)# okc

Use the no form of this command to disable the OKC feature.

Opportunistic Key Caching is now enabled on the specified WLAN, allowing wireless clients to experience improved roaming performance when moving between access points.

Enable opportunistic key caching (GUI)

Enable opportunistic key caching to improve wireless network performance by allowing devices to cache encryption keys for faster roaming between access points.

Opportunistic key caching (OKC) is configured through the WLAN settings in the Advanced tab. This feature is enabled by default but can be managed based on your network security requirements.

Procedure

1.

Choose Configuration > Tags & Profiles > WLANs.
2.

Click Add.

The Add WLAN dialog box is displayed.
3.

In the Add WLAN dialog box, click the Advanced tab and complete the following procedure:

  1. In the 11ax section, check the OKC check box to disable or enable the feature. By default this feature is enabled.

  2. Click Update & Apply to Device.

Opportunistic key caching is configured according to your selection. The WLAN settings are updated and applied to the device.

Verify opportunistic key caching

Verify whether opportunistic key caching (OKC) is disabled for a WLAN profile using show commands.

These example shows how to verify whether OKC is disabled for a WLAN profile.

Device# show wlan id 18 
WLAN Profile Name     : 18%wlanprofile
================================================
Identifier                                     : 18
Description                                    :
Network Name (SSID)                            : san-ssid
Status                                         : Disabled
Broadcast SSID                                 : Enabled
Advertise-Apname                               : Disabled
Universal AP Admin                             : Disabled
Max Associated Clients per WLAN                : 0
Max Associated Clients per AP per WLAN         : 0
Max Associated Clients per AP Radio per WLAN   : 200
OKC                                            : Disabled
Number of Active Clients                       : 0
CHD per WLAN                                   : Enabled
WMM                                            : Allowed
Channel Scan Defer Priority:
  Priority (default)                           : 5
  Priority (default)                           : 6
Scan Defer Time (msecs)                        : 100
Media Stream Multicast-direct                  : Disabled
CCX - AironetIe Support                        : Disabled
Peer-to-Peer Blocking Action                   : Disabled
Radio Policy                                   : All
Device# show run wlan 
wlan name 2 ssid-name
wlan test 24 test
wlan test2 15 test2
wlan test4 12 testssid
 radio dot11a
wlan wlan1 234 wlan1
wlan wlan2 14 wlan-aaa
 security dot1x authentication-list realm
wlan wlan7 27 wlan7
wlan test23 17 test23
wlan wlan_1 4 ssid_name
 security dot1x authentication-list authenticate_list_name
wlan wlan_3 5 ssid_3
 security wpa wpa1
 security wpa wpa1 ciphers aes
wlan wlan_8 9 ssid_name
 no security wpa
 no security wpa wpa2
 no security wpa wpa2 ciphers aes
 no security wpa akm dot1x
 security web-auth
wlan test-wlan 23 test-wlan
wlan wlan-test 1 wlan2
 mac-filtering default
wlan 18%wlanprofile 18 san-ssid
 no okc