I am trying to set up a wireless LAN using two Cisco 3602i APs on a Virtual WLC running software version 8.2.160.0. My goal is to have an iPhone 6s using Voice-over-WiFi be able to fast-roam between these two APs using 802.11r/802.11k/802.11v without dropping the voice call.
As far as I can tell, I have set everything up for this according to Cisco and Apple recommendations, but the handoffs continually fail. Running 'debug client <iphone-mac-address>' on the controller produces the following message when the handoff attempts fail:
Association Failed on REAP AP BSSID 44:ad:d9:8e:8b:fe (slot 1), status 11 0 802.11r Key Cache look up failed in (re)-assoc req
Unfortunately, a Google search for "key cache look up failed" returns only one result – an un-annotated pastebin dump.
Here is the vWLC configuration for the WLAN in question, id '2', SSID 'phone-test-5g':
(Cisco Controller) >show wlan 2
WLAN Identifier.................................. 2
Profile Name..................................... phone-test-5g
Network Name (SSID).............................. phone-test-5g
Status........................................... Enabled
MAC Filtering.................................... Disabled
Broadcast SSID................................... Enabled
AAA Policy Override.............................. Disabled
Network Admission Control
Client Profiling Status
Radius Profiling ............................ Disabled
DHCP ....................................... Disabled
HTTP ....................................... Disabled
Local Profiling ............................. Disabled
DHCP ....................................... Disabled
HTTP ....................................... Disabled
Radius-NAC State............................... Disabled
SNMP-NAC State................................. Disabled
Quarantine VLAN................................ 0
Maximum number of Associated Clients............. 0
Maximum number of Clients per AP Radio........... 200
--More-- or (q)uit
ATF Policy....................................... 0
Number of Active Clients......................... 0
Exclusionlist Timeout............................ 60 seconds
Session Timeout.................................. 1800 seconds
User Idle Timeout................................ Disabled
Sleep Client..................................... disable
Sleep Client Timeout............................. 720 minutes
User Idle Threshold.............................. 0 Bytes
NAS-identifier................................... none
CHD per WLAN..................................... Enabled
Webauth DHCP exclusion........................... Disabled
Interface........................................ management
Multicast Interface.............................. Not Configured
WLAN IPv4 ACL.................................... unconfigured
WLAN IPv6 ACL.................................... unconfigured
WLAN Layer2 ACL.................................. unconfigured
mDNS Status...................................... Disabled
mDNS Profile Name................................ unconfigured
DHCP Server...................................... Default
DHCP Address Assignment Required................. Disabled
Static IP client tunneling....................... Disabled
Tunnel Profile................................... Unconfigured
Quality of Service............................... Silver
--More-- or (q)uit
Per-SSID Rate Limits............................. Upstream Downstream
Average Data Rate................................ 0 0
Average Realtime Data Rate....................... 0 0
Burst Data Rate.................................. 0 0
Burst Realtime Data Rate......................... 0 0
Per-Client Rate Limits........................... Upstream Downstream
Average Data Rate................................ 0 0
Average Realtime Data Rate....................... 0 0
Burst Data Rate.................................. 0 0
Burst Realtime Data Rate......................... 0 0
Scan Defer Priority.............................. 4,5,6
Scan Defer Time.................................. 100 milliseconds
WMM.............................................. Allowed
WMM UAPSD Compliant Client Support............... Disabled
Media Stream Multicast-direct.................... Disabled
CCX - AironetIe Support.......................... Enabled
CCX - Gratuitous ProbeResponse (GPR)............. Disabled
CCX - Diagnostics Channel Capability............. Disabled
Dot11-Phone Mode (7920).......................... Disabled
Wired Protocol................................... 802.1P (Tag=0)
Passive Client Feature........................... Disabled
Peer-to-Peer Blocking Action..................... Disabled
Radio Policy..................................... 802.11a only
--More-- or (q)uit
DTIM period for 802.11a radio.................... 1
DTIM period for 802.11b radio.................... 1
Radius Servers
Authentication................................ Disabled
Accounting.................................... Disabled
Dynamic Interface............................. Disabled
Dynamic Interface Priority.................... wlan
Local EAP Authentication......................... Disabled
Radius NAI-Realm................................. Disabled
Mu-Mimo.......................................... Enabled
Security
802.11 Authentication:........................ Open System
FT Support.................................... Enabled
Static WEP Keys............................... Disabled
802.1X........................................ Disabled
Wi-Fi Protected Access (WPA/WPA2)............. Enabled
WPA (SSN IE)............................... Disabled
WPA2 (RSN IE).............................. Enabled
TKIP Cipher............................. Disabled
AES Cipher.............................. Enabled
OSEN IE.................................... Disabled
Auth Key Management
--More-- or (q)uit
802.1x.................................. Disabled
PSK..................................... Disabled
CCKM.................................... Disabled
FT-1X(802.11r).......................... Disabled
FT-PSK(802.11r)......................... Enabled
PMF-1X(802.11w)......................... Disabled
PMF-PSK(802.11w)........................ Disabled
OSEN-1X................................. Disabled
FT Reassociation Timeout................... 20
FT Over-The-DS mode........................ Disabled
GTK Randomization.......................... Disabled
SKC Cache Support.......................... Disabled
CCKM TSF Tolerance......................... 1000
Wi-Fi Direct policy configured................ Disabled
EAP-Passthrough............................... Disabled
CKIP ......................................... Disabled
Web Based Authentication...................... Disabled
Web Authentication Timeout.................... 300
Web-Passthrough............................... Disabled
Mac-auth-server............................... 0.0.0.0
Web-portal-server............................. 0.0.0.0
Conditional Web Redirect...................... Disabled
Splash-Page Web Redirect...................... Disabled
--More-- or (q)uit
Auto Anchor................................... Disabled
FlexConnect Local Switching................... Enabled
FlexConnect Central Association............... Enabled
flexconnect Central Dhcp Flag................. Disabled
flexconnect nat-pat Flag...................... Disabled
flexconnect Dns Override Flag................. Disabled
flexconnect PPPoE pass-through................ Disabled
flexconnect local-switching IP-source-guar.... Disabled
FlexConnect Vlan based Central Switching ..... Disabled
FlexConnect Local Authentication.............. Disabled
FlexConnect Learn IP Address.................. Enabled
Client MFP.................................... Optional
PMF........................................... Disabled
PMF Association Comeback Time................. 1
PMF SA Query RetryTimeout..................... 200
Tkip MIC Countermeasure Hold-down Timer....... 60
Eap-params.................................... Disabled
Flex Avc Profile Name............................ None
Flow Monitor Name................................ None
Split Tunnel Configuration
Split Tunnel................................. Disabled
Call Snooping.................................... Disabled
Roamed Call Re-Anchor Policy..................... Disabled
--More-- or (q)uit
SIP CAC Fail Send-486-Busy Policy................ Enabled
SIP CAC Fail Send Dis-Association Policy......... Disabled
KTS based CAC Policy............................. Disabled
Assisted Roaming Prediction Optimization......... Disabled
802.11k Neighbor List............................ Enabled
802.11k Neighbor List Dual Band.................. Disabled
802.11v Directed Multicast Service............... Disabled
802.11v BSS Max Idle Service..................... Enabled
802.11v BSS Transition Service................... Enabled
802.11v BSS Transition Disassoc Imminent......... Disabled
802.11v BSS Transition Disassoc Timer............ 200
802.11v BSS Transition OpRoam Disassoc Timer..... 40
DMS DB is empty
Band Select...................................... Disabled
Load Balancing................................... Disabled
Multicast Buffer................................. Disabled
Universal Ap Admin............................... Disabled
Mobility Anchor List
WLAN ID IP Address Status Priority
------- --------------- ------ --------
802.11u........................................ Disabled
--More-- or (q)uit
MSAP Services.................................. Disabled
Local Policy
----------------
Priority Policy Name
-------- ---------------
(Cisco Controller) >
And here is the complete output of a 'debug client ' capturing a failed roam/handoff event:
(Cisco Controller) >*apfMsConnTask_5: Aug 13 00:50:21.187: cc:20:e8:7f:64:8c Doing preauth for this client over the Air
*apfMsConnTask_5: Aug 13 00:50:21.187: cc:20:e8:7f:64:8c Doing local roaming for destination address 44:ad:d9:8e:8b:fe
*apfMsConnTask_5: Aug 13 00:50:21.187: cc:20:e8:7f:64:8c Got 1 AKMs in RSNIE
*apfMsConnTask_5: Aug 13 00:50:21.187: cc:20:e8:7f:64:8c RSNIE AKM matches with PMK cache entry :0x4
*apfMsConnTask_5: Aug 13 00:50:21.187: cc:20:e8:7f:64:8c Created a new preauth entry for AP:44:ad:d9:8e:8b:fe
*spamApTask0: Aug 13 00:50:21.189: cc:20:e8:7f:64:8c Association Failed on REAP AP BSSID 44:ad:d9:8e:8b:fe (slot 1), status 11 0 802.11r Key Cache look up failed in (re)-assoc req
*spamApTask0: Aug 13 00:50:21.189: cc:20:e8:7f:64:8c apfMsDeleteByMscb Scheduling mobile for deletion with deleteReason 8, reasonCode 1
*spamApTask0: Aug 13 00:50:21.189: cc:20:e8:7f:64:8c Scheduling deletion of Mobile Station: (callerId: 30) in 1 seconds
*spamApTask0: Aug 13 00:50:21.190: cc:20:e8:7f:64:8c Received DELETE mobile, reason UNKNOWN, from AP 44:ad:d9:8e:8b:f0, slot 1 ...cleaning up mscb
*spamApTask0: Aug 13 00:50:21.190: cc:20:e8:7f:64:8c Warning, ignore the DELETE_MOBILE_PAYLOAD from AP: 44:ad:d9:8e:8b:f0, slot 1. STA connecting AP: 68:99:cd:51:75:d0, slot 1
*apfMsConnTask_5: Aug 13 00:50:21.531: cc:20:e8:7f:64:8c Doing preauth for this client over the Air
*apfMsConnTask_5: Aug 13 00:50:21.531: cc:20:e8:7f:64:8c Doing local roaming for destination address 44:ad:d9:8e:8b:fe
*apfMsConnTask_5: Aug 13 00:50:21.531: cc:20:e8:7f:64:8c Got 1 AKMs in RSNIE
*apfMsConnTask_5: Aug 13 00:50:21.531: cc:20:e8:7f:64:8c RSNIE AKM matches with PMK cache entry :0x4
*apfMsConnTask_5: Aug 13 00:50:21.531: cc:20:e8:7f:64:8c Removing TGr reauth entry for AP 44:ad:d9:8e:8b:fe
*apfMsConnTask_5: Aug 13 00:50:21.531: cc:20:e8:7f:64:8c Created a new preauth entry for AP:44:ad:d9:8e:8b:fe
*spamApTask0: Aug 13 00:50:21.533: cc:20:e8:7f:64:8c Association Failed on REAP AP BSSID 44:ad:d9:8e:8b:fe (slot 1), status 11 0 802.11r Key Cache look up failed in (re)-assoc req
*spamApTask0: Aug 13 00:50:21.533: cc:20:e8:7f:64:8c ignore the mscb delete request,mscb is already marked for deletion and being deletedAP:44:ad:d9:8e:8b:fe (slot 1)
*spamApTask0: Aug 13 00:50:21.535: cc:20:e8:7f:64:8c Received DELETE mobile, reason UNKNOWN, from AP 44:ad:d9:8e:8b:f0, slot 1 ...cleaning up mscb
*spamApTask0: Aug 13 00:50:21.535: cc:20:e8:7f:64:8c Warning, ignore the DELETE_MOBILE_PAYLOAD from AP: 44:ad:d9:8e:8b:f0, slot 1. STA connecting AP: 68:99:cd:51:75:d0, slot 1
*apfMsConnTask_5: Aug 13 00:50:21.875: cc:20:e8:7f:64:8c Doing preauth for this client over the Air
*apfMsConnTask_5: Aug 13 00:50:21.875: cc:20:e8:7f:64:8c Doing local roaming for destination address 44:ad:d9:8e:8b:fe
*apfMsConnTask_5: Aug 13 00:50:21.875: cc:20:e8:7f:64:8c Got 1 AKMs in RSNIE
*apfMsConnTask_5: Aug 13 00:50:21.875: cc:20:e8:7f:64:8c RSNIE AKM matches with PMK cache entry :0x4
*apfMsConnTask_5: Aug 13 00:50:21.875: cc:20:e8:7f:64:8c Removing TGr reauth entry for AP 44:ad:d9:8e:8b:fe
*apfMsConnTask_5: Aug 13 00:50:21.875: cc:20:e8:7f:64:8c Created a new preauth entry for AP:44:ad:d9:8e:8b:fe
*spamApTask0: Aug 13 00:50:21.877: cc:20:e8:7f:64:8c Association Failed on REAP AP BSSID 44:ad:d9:8e:8b:fe (slot 1), status 11 0 802.11r Key Cache look up failed in (re)-assoc req
*spamApTask0: Aug 13 00:50:21.877: cc:20:e8:7f:64:8c ignore the mscb delete request,mscb is already marked for deletion and being deletedAP:44:ad:d9:8e:8b:fe (slot 1)
*spamApTask0: Aug 13 00:50:21.878: cc:20:e8:7f:64:8c Received DELETE mobile, reason UNKNOWN, from AP 44:ad:d9:8e:8b:f0, slot 1 ...cleaning up mscb
*spamApTask0: Aug 13 00:50:21.878: cc:20:e8:7f:64:8c Warning, ignore the DELETE_MOBILE_PAYLOAD from AP: 44:ad:d9:8e:8b:f0, slot 1. STA connecting AP: 68:99:cd:51:75:d0, slot 1
*osapiBsnTimer: Aug 13 00:50:22.107: cc:20:e8:7f:64:8c apfMsExpireCallback (apf_ms.c:638) Expiring Mobile!
*apfReceiveTask: Aug 13 00:50:22.107: cc:20:e8:7f:64:8c apfMsExpireMobileStation (apf_ms.c:7442) Changing state for mobile cc:20:e8:7f:64:8c on AP 68:99:cd:51:75:d0 from Associated to Disassociated
*apfReceiveTask: Aug 13 00:50:22.108: cc:20:e8:7f:64:8c apfSendDisAssocMsgDebug (apf_80211.c:3459) Changing state for mobile cc:20:e8:7f:64:8c on AP 68:99:cd:51:75:d0 from Disassociated to Disassociated
*apfReceiveTask: Aug 13 00:50:22.108: cc:20:e8:7f:64:8c Sent Disassociate to mobile on AP 68:99:cd:51:75:d0-1 (reason 1, caller apf_ms.c:7538)
*apfReceiveTask: Aug 13 00:50:22.108: cc:20:e8:7f:64:8c Sent Deauthenticate to mobile on BSSID 68:99:cd:51:75:de slot 1(caller apf_ms.c:7540)
*apfReceiveTask: Aug 13 00:50:22.108: cc:20:e8:7f:64:8c Resetting MSCB PMK Cache Entry 0 for station cc:20:e8:7f:64:8c
*apfReceiveTask: Aug 13 00:50:22.108: cc:20:e8:7f:64:8c Removing BSSID 68:99:cd:51:75:de from PMKID cache of station cc:20:e8:7f:64:8c
*apfReceiveTask: Aug 13 00:50:22.108: cc:20:e8:7f:64:8c Setting active key cache index 0 ---> 8
*apfReceiveTask: Aug 13 00:50:22.108: cc:20:e8:7f:64:8c Deleting the PMK cache when de-authenticating the client.
*apfReceiveTask: Aug 13 00:50:22.108: cc:20:e8:7f:64:8c DOT11R: Sending cache delete
*apfReceiveTask: Aug 13 00:50:22.108: cc:20:e8:7f:64:8c Removing PMK cache entry for station cc:20:e8:7f:64:8c
*apfReceiveTask: Aug 13 00:50:22.108: cc:20:e8:7f:64:8c Removing TGr reauth entry on AP station 44:ad:d9:8e:8b:fe
*apfReceiveTask: Aug 13 00:50:22.108: cc:20:e8:7f:64:8c apfMsAssoStateDec
*apfReceiveTask: Aug 13 00:50:22.108: cc:20:e8:7f:64:8c apfMsExpireMobileStation (apf_ms.c:7581) Changing state for mobile cc:20:e8:7f:64:8c on AP 68:99:cd:51:75:d0 from Disassociated to Idle
*apfReceiveTask: Aug 13 00:50:22.109: cc:20:e8:7f:64:8c pemApfDeleteMobileStation2: APF_MS_PEM_WAIT_L2_AUTH_COMPLETE = 0.
*apfReceiveTask: Aug 13 00:50:22.109: cc:20:e8:7f:64:8c 10.1.0.13 START (0) Deleted mobile LWAPP rule on AP [68:99:cd:51:75:d0]
*apfReceiveTask: Aug 13 00:50:22.109: cc:20:e8:7f:64:8c Deleting mobile on AP 68:99:cd:51:75:d0(1)
*spamApTask1: Aug 13 00:50:22.119: cc:20:e8:7f:64:8c apfUpdateDeleteAckInMscb (apf_api.c:50821) Expiring Mobile!
*apfMsConnTask_5: Aug 13 00:50:22.218: cc:20:e8:7f:64:8c no PMK cache entry for this client. Can't do preauth.
*spamApTask0: Aug 13 00:50:22.220: cc:20:e8:7f:64:8c Association Failed on REAP AP BSSID 44:ad:d9:8e:8b:fe (slot 1), status 11 0 802.11r Key Cache look up failed in (re)-assoc req
*spamApTask0: Aug 13 00:50:22.221: cc:20:e8:7f:64:8c Received DELETE mobile, reason UNKNOWN, from AP 44:ad:d9:8e:8b:f0, slot 1 ...cleaning up mscb
*apfMsConnTask_5: Aug 13 00:50:22.562: cc:20:e8:7f:64:8c no PMK cache entry for this client. Can't do preauth.
*spamApTask0: Aug 13 00:50:22.564: cc:20:e8:7f:64:8c Association Failed on REAP AP BSSID 44:ad:d9:8e:8b:fe (slot 1), status 11 0 802.11r Key Cache look up failed in (re)-assoc req
*spamApTask0: Aug 13 00:50:22.565: cc:20:e8:7f:64:8c Received DELETE mobile, reason UNKNOWN, from AP 44:ad:d9:8e:8b:f0, slot 1 ...cleaning up mscb
*apfMsConnTask_5: Aug 13 00:50:54.724: cc:20:e8:7f:64:8c no PMK cache entry for this client. Can't do preauth.
*spamApTask0: Aug 13 00:50:54.726: cc:20:e8:7f:64:8c Association Failed on REAP AP BSSID 44:ad:d9:8e:8b:fe (slot 1), status 11 0 802.11r Key Cache look up failed in (re)-assoc req
*spamApTask0: Aug 13 00:50:54.727: cc:20:e8:7f:64:8c Received DELETE mobile, reason UNKNOWN, from AP 44:ad:d9:8e:8b:f0, slot 1 ...cleaning up mscb
*apfMsConnTask_5: Aug 13 00:50:55.066: cc:20:e8:7f:64:8c no PMK cache entry for this client. Can't do preauth.
*spamApTask0: Aug 13 00:50:55.069: cc:20:e8:7f:64:8c Association Failed on REAP AP BSSID 44:ad:d9:8e:8b:fe (slot 1), status 11 0 802.11r Key Cache look up failed in (re)-assoc req
*spamApTask0: Aug 13 00:50:55.070: cc:20:e8:7f:64:8c Received DELETE mobile, reason UNKNOWN, from AP 44:ad:d9:8e:8b:f0, slot 1 ...cleaning up mscb
*apfMsConnTask_5: Aug 13 00:50:55.410: cc:20:e8:7f:64:8c no PMK cache entry for this client. Can't do preauth.
*spamApTask0: Aug 13 00:50:55.412: cc:20:e8:7f:64:8c Association Failed on REAP AP BSSID 44:ad:d9:8e:8b:fe (slot 1), status 11 0 802.11r Key Cache look up failed in (re)-assoc req
*spamApTask0: Aug 13 00:50:55.413: cc:20:e8:7f:64:8c Received DELETE mobile, reason UNKNOWN, from AP 44:ad:d9:8e:8b:f0, slot 1 ...cleaning up mscb
*apfMsConnTask_5: Aug 13 00:50:55.754: cc:20:e8:7f:64:8c no PMK cache entry for this client. Can't do preauth.
*spamApTask0: Aug 13 00:50:55.756: cc:20:e8:7f:64:8c Association Failed on REAP AP BSSID 44:ad:d9:8e:8b:fe (slot 1), status 11 0 802.11r Key Cache look up failed in (re)-assoc req
*spamApTask0: Aug 13 00:50:55.757: cc:20:e8:7f:64:8c Received DELETE mobile, reason UNKNOWN, from AP 44:ad:d9:8e:8b:f0, slot 1 ...cleaning up mscb
*apfMsConnTask_5: Aug 13 00:50:56.097: cc:20:e8:7f:64:8c no PMK cache entry for this client. Can't do preauth.
*spamApTask0: Aug 13 00:50:56.099: cc:20:e8:7f:64:8c Association Failed on REAP AP BSSID 44:ad:d9:8e:8b:fe (slot 1), status 11 0 802.11r Key Cache look up failed in (re)-assoc req
*spamApTask0: Aug 13 00:50:56.100: cc:20:e8:7f:64:8c Received DELETE mobile, reason UNKNOWN, from AP 44:ad:d9:8e:8b:f0, slot 1 ...cleaning up mscb
*apfMsConnTask_5: Aug 13 00:51:57.477: cc:20:e8:7f:64:8c no PMK cache entry for this client. Can't do preauth.
*spamApTask0: Aug 13 00:51:57.479: cc:20:e8:7f:64:8c Association Failed on REAP AP BSSID 44:ad:d9:8e:8b:fe (slot 1), status 11 0 802.11r Key Cache look up failed in (re)-assoc req
*spamApTask0: Aug 13 00:51:57.480: cc:20:e8:7f:64:8c Received DELETE mobile, reason UNKNOWN, from AP 44:ad:d9:8e:8b:f0, slot 1 ...cleaning up mscb
*apfMsConnTask_5: Aug 13 00:51:57.821: cc:20:e8:7f:64:8c no PMK cache entry for this client. Can't do preauth.
*spamApTask0: Aug 13 00:51:57.823: cc:20:e8:7f:64:8c Association Failed on REAP AP BSSID 44:ad:d9:8e:8b:fe (slot 1), status 11 0 802.11r Key Cache look up failed in (re)-assoc req
*spamApTask0: Aug 13 00:51:57.824: cc:20:e8:7f:64:8c Received DELETE mobile, reason UNKNOWN, from AP 44:ad:d9:8e:8b:f0, slot 1 ...cleaning up mscb
*apfMsConnTask_5: Aug 13 00:51:58.165: cc:20:e8:7f:64:8c no PMK cache entry for this client. Can't do preauth.
*spamApTask0: Aug 13 00:51:58.167: cc:20:e8:7f:64:8c Association Failed on REAP AP BSSID 44:ad:d9:8e:8b:fe (slot 1), status 11 0 802.11r Key Cache look up failed in (re)-assoc req
*spamApTask0: Aug 13 00:51:58.168: cc:20:e8:7f:64:8c Received DELETE mobile, reason UNKNOWN, from AP 44:ad:d9:8e:8b:f0, slot 1 ...cleaning up mscb
*apfMsConnTask_5: Aug 13 00:51:58.509: cc:20:e8:7f:64:8c no PMK cache entry for this client. Can't do preauth.
*spamApTask0: Aug 13 00:51:58.511: cc:20:e8:7f:64:8c Association Failed on REAP AP BSSID 44:ad:d9:8e:8b:fe (slot 1), status 11 0 802.11r Key Cache look up failed in (re)-assoc req
*spamApTask0: Aug 13 00:51:58.512: cc:20:e8:7f:64:8c Received DELETE mobile, reason UNKNOWN, from AP 44:ad:d9:8e:8b:f0, slot 1 ...cleaning up mscb
*apfMsConnTask_5: Aug 13 00:51:58.853: cc:20:e8:7f:64:8c no PMK cache entry for this client. Can't do preauth.
*spamApTask0: Aug 13 00:51:58.855: cc:20:e8:7f:64:8c Association Failed on REAP AP BSSID 44:ad:d9:8e:8b:fe (slot 1), status 11 0 802.11r Key Cache look up failed in (re)-assoc req
*spamApTask0: Aug 13 00:51:58.857: cc:20:e8:7f:64:8c Received DELETE mobile, reason UNKNOWN, from AP 44:ad:d9:8e:8b:f0, slot 1 ...cleaning up mscb
I have tried a fairly wide variety of configurations but have not been able to get this to work using any combination of settings. If anyone has any suggestions, I will greatly appreciate hearing them.
Best Answer
You may try turning off 802.11r in the AP and make sure your IOS is 10 or higher in case it's conflicting. IOS 10 and up have adaptive 801.11r and do not need it turned on in the AP. Reference link to Apple doc...
Quote from Apple... 802.11r
When your iOS device roams from one AP to another on the same network, 802.11r uses a feature called Fast Basic Service Set Transition (FT) to authenticate more quickly. FT works with both preshared key (PSK) and 802.1X authentication methods.
iOS 10 includes support for adaptive 802.11r on Cisco wireless networks. Adaptive 802.11r offers FT without the need to enable 802.11r on the configured Cisco wireless network.
If that doesn't work out you could look into this. It was used before 11r. OKC option... I may have overlooked it in the config but have you tried opportunistic key caching OKC as described in this doc link to extensive Cisco doc instead of PKC and is there a Validate PMKID option? I didn't see it but this may be beneficial.