Configuring and managing Mobility Domain roaming 223
Nortel WLAN—Security Switch 2300 Series Configuration Guide
The command “set cluster preempt enable” can be configured on the secondary seed WSS, if you have configured one as
part of the Mobility Domain, to override the primary seed configuration if the primary and secondary seed become
disconnected. Once the primary seed WSS is available, the primary seed manages the cluster configuration again. This
command is not persistent and you have to set preempt again if the WSS resets.

Virtual Controller Cluster Configuration Parameters

The following configuration parameters are also shared as part of the cluster configuration:
• ACLs - are implemented as follows:
• ACLs that refer to an AP must be configured on the seed WSS.
• ACLs defined on a seed WSS are shared with members.
• ACL mapping to ports, VLANs, and vports can be defined on the member WSSs for locally defined ACLs.
• If there are conflicting ACL names, the local ACL takes precedence and the incident is logged to the event log.
• Mobility profiles - have the following configuration constraints:
• Mobility profiles must be configured on the Primary seed.
• Mobility profiles with reference ports are not accepted by the configuration.
• Location policies - can be configured as follows:
• On the seed WSS.
• Profiles with port references are not allowed.
• QoS profiles

Configuring secure WSS to WSS communications

You can enhance security on your network by enabling Secure WSS to WSS communications. Secure WSS to WSS
communications encrypts management traffic exchanged by WSSs in a Mobility Domain.
When Secure WSS to WSS communications is enabled, management traffic among WSSs in the Mobility Domain is
encrypted using AES. The keying material is dynamically generated for each session and passed among switches using
public keys that you configure. The public keys used on the seed and member switches for the Mobility Domain security
mode are generated by the crypto generate key domain 128 command.
• On the Mobility Domain seed switch, when you specify the IP addresses and public keys for each member switch,
the member switches’ public keys need to be obtained from each member switch by issuing the show crypto domain
key command on each member switch.
• On the Mobility Domain member switches, when you specify the IP address and public key for the seed switch, the
public key used is obtained from the seed switch by issuing the show crypto domain key command on the Mobility
Domain seed switch.
To configure Secure WSS to WSS communications:
• Set Mobility Domain security on each switch to required. The default setting is none. Secure WSS to WSS
communications can be disabled or enabled on a Mobility Domain basis. The feature must have the same setting