Mobility anchoring requires that the same WLAN (SSID, WLAN-ID, security type, PSK, and policy) exist on both the foreign and the anchor WLC. If the anchor lacks a matching WLAN, the mobility tunnel creation fails and the client association is rejected, which is what the Radioactive Trace is reporting. Creating the identical WLAN on the anchor resolves the issue.

A. 802.11r only affects fast-roam hand-shakes; it does not stop the initial association of all clients.

B. PSK mismatch is checked at the foreign WLC/AP, independent of anchoring; the trace points to mobility failure, not bad keys.

C. Removing the anchor breaks the required DMZ design goal rather than fixing the authentication failure.

1. Cisco Wireless LAN Controller Config Guide, Rel 8.10, “Configuring Mobility Anchors”, section “WLAN Requirements” – “The same WLAN ID, SSID and security parameters must be configured on both foreign and anchor, or clients cannot associate.”

2. Cisco Live BRKEWN-2033, 2022, slide 36 “Client fails when anchor WLAN absent/mismatched – seen in RA trace as WLAN-ID mismatch.”

3. Cisco TAC Case Collection, Doc ID 116419, “Association denied when anchor lacks matching WLAN”, para 3.