Subject: [Capwap] Questions on the 802.11i and Interoperability for CAPWAP protocol

From: "Richard Gwee" <[email-masked]>
Date: Thu, 28 Jul 2005 22:59:35 +0800

Hi,
 
I have a few questions to make.
 
For the 802.11i considerations objective, we have to take into account an architecture in which the AC provides authentication function while the WTP provides the encryption function. I believe such architecture is highly likely and need to be considered seriously. However, in some of the proposed protocols, i notice that such designs are not discussed thoroughly. Most protocols discuss on how the AC and WTP can perform security updates. In my opinion, the way on how the CAPWAP protocol can best perform under this kind of architecture is rather important. Is this aspect supposed to be implementation specific or can i be enlightened on how the CAPWAP protocol can be used effectively on such an architecture?
 
For the interoperability objective, most protocols does mention support for this objective in their specifications but i cannot figure out how is this objective fulfilled. In the event that there is two types of WTP i.e. local MAC and split MAC WTPs linked to a single AC, how will the AC manage the traffic from these two types of WTPs? Ideally, the AC should be able to handle traffic from both types of WTPs without much hassle.
 
Appreciate any reply and comments.
 
Thanks and regards
Richard Gwee

Republic Polytechnic, Tanglin Campus, 1 Kay Siang Road, Singapore 248922 . Website: www.rp.sg . Fax: +65 6415-1310 .

Republic Polytechnic, the first Institute of Higher Learning to fully adopt the Problem-Based Learning approach in Singapore, continues to strive towards best practices and maintain excellence in service standards with the following certifications: Singapore Quality Class (SQC) certification, People Developer Standards and QEHS standards (ISO 9001, 14001 and OHSAS 18001 certifications).
---------------------------------------------------------------------
CONFIDENTIALITY CAUTION: This message is intended only for the use of the individual or entity to whom it is addressed and contains information that is privileged and confidential. If you, the reader of this message, are not the intended recipient, you should not disseminate, distribute or copy this communication. If you have received this communication in error, please notify us immediately by return email and delete the original message. Thank you.

_______________________________________________
Capwap mailing list
[email-masked]
http://mail.frascone.com/mailman/listinfo/capwap

---

From: "Pat Calhoun (pacalhou)" <[email-masked]>
Date: Thu, 28 Jul 2005 09:00:35 -0700

Richard,

Once more a good question. The issue you raised is not only required for
interoperability, but as correctly pointed out by Charles Clancy in his
LWAPP security review, failure to mention proper protocol behavior can
lead to system vulnerabilities and possible DoS attacks. 

LWAPP has addressed this issue in section 11.2, which does into detail
on how the AC uses the LWAPP protocol in light of an 802.11i roaming
event. The process describes addresses the security issue raised during
the review process, and is sufficient to ensure interoperability.

Note that the introduction of 802.11r will significantly simplify how
secure roaming works, but that standard isn't expected for at least
another year. 

To address your second question, how does roaming from a Local to Split
MAC WTP occur is an interesting question, and is one that only works
with specific deployment constraints. If a user begins his session on a
Split MAC WTP, he/she will be assigned an IP address from one of the
subnets supported by the AC. However, if a roam event occurs to a Local
MAC WTP, which for me means no tunneling of user data to the AC, then
that WTP would also have to have access to the same VLANs as the ones on
the AC. So this scenario works as long as the AC and the WTP have access
to the same user VLAN/subnets.

Pat Calhoun
CTO, Wireless Networking Business Unit
Cisco Systems

> -----Original Message-----
> From: [email-masked] 
> [mailto:[email-masked]] On Behalf Of Richard Gwee
> Sent: Thursday, July 28, 2005 8:00 AM
> To: [email-masked]
> Subject: [Capwap] Questions on the 802.11i and 
> Interoperability for CAPWAP protocol
> 
> Hi,
>  
> For the 802.11i considerations objective, we have to take 
> into account an architecture in which the AC provides 
> authentication function while the WTP provides the encryption 
> function. I believe such architecture is highly likely and 
> need to be considered seriously. However, in some of the 
> proposed protocols, i notice that such designs are not 
> discussed thoroughly. Most protocols discuss on how the AC 
> and WTP can perform security updates. In my opinion, the way 
> on how the CAPWAP protocol can best perform under this kind 
> of architecture is rather important. Is this aspect supposed 
> to be implementation specific or can i be enlightened on how 
> the CAPWAP protocol can be used effectively on such an architecture?
>  
> For the interoperability objective, most protocols does 
> mention support for this objective in their specifications 
> but i cannot figure out how is this objective fulfilled. In 
> the event that there is two types of WTP i.e. local MAC and 
> split MAC WTPs linked to a single AC, how will the AC manage 
> the traffic from these two types of WTPs? Ideally, the AC 
> should be able to handle traffic from both types of WTPs 
> without much hassle.
>  
> Republic Polytechnic, Tanglin Campus, 1 Kay Siang Road, 
> Singapore 248922 . Website: www.rp.sg . Fax: +65 6415-1310 .
> 
> Republic Polytechnic, the first Institute of Higher Learning 
> to fully adopt the Problem-Based Learning approach in 
> Singapore, continues to strive towards best practices and 
> maintain excellence in service standards with the following 
> certifications: Singapore Quality Class (SQC) certification, 
> People Developer Standards and QEHS standards (ISO 9001, 
> 14001 and OHSAS 18001 certifications).
> CONFIDENTIALITY CAUTION: This message is intended only for 
> the use of the individual or entity to whom it is addressed 
> and contains information that is privileged and confidential. 
> If you, the reader of this message, are not the intended 
> recipient, you should not disseminate, distribute or copy 
> this communication. If you have received this communication 
> in error, please notify us immediately by return email and 
> delete the original message. Thank you.
>

---

From: <[email-masked]>
Date: Thu, 28 Jul 2005 12:13:33 -0700

Hi Richard-

Thanks for the comments on the protocols and requirements.  We just finished an WG Last Call on the Objectives draft, and although some of your comments are addressed there at a high level, I thought I'd give you an opportunity to expand on the objectives if you like, espcially since we've haven't received any comments during WGLC so far, and I can't submit the Objectives draft to the IESG until after the IETF 63 meeting.

Additionally, the evaluation team will report on their findings and release their draft at the IETF meeting.  You can also raise these points with the evaluation team, during the meeting if you are attending, or on the WG list when the WG has a chance to comment.  They have done an excellent job so far.

As we finalize the evaluation process and protocol, the WG will have an opportunity to further refine the protocol to address comments such as yours.

Thanks,
Dorothy

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On
Behalf Of ext Richard Gwee
Sent: Thursday, July 28, 2005 8:00 AM
To: [email-masked]
Subject: [Capwap] Questions on the 802.11i and Interoperability for
CAPWAP protocol

Hi,

 

Thanks and regards
Richard Gwee

---

From: "Pat Calhoun (pacalhou)" <[email-masked]>
Date: Fri, 29 Jul 2005 11:12:56 -0700

I believe that Richard made a really good point that the Logical groups
objective is not sufficient. 

The current Protocol Requirements text reads:

"The CAPWAP protocol MUST be capable of controlling and managingphysical
WTPs in terms of logical groups including BSSID-based groups."

I would re-phrase to:

"The CAPWAP protocol MUST be capable of controlling and managing
physical WTPs in terms of logical groups including BSSID-based groups.
For non-tunneled mode, the protocols MUST also provide the provisions to
configure the associated VLAN (or subnet) which is to be used by the WTP
in bridging traffic for the logical group."

Pat Calhoun

> [mailto:[email-masked]] On Behalf Of 
> [email-masked]
> Sent: Thursday, July 28, 2005 12:14 PM
> To: [email-masked]; [email-masked]
> Cc: [email-masked]
> Subject: RE: [Capwap] Questions on the 802.11i and 
> Thanks for the comments on the protocols and requirements.  
> We just finished an WG Last Call on the Objectives draft, and 
> although some of your comments are addressed there at a high 
> level, I thought I'd give you an opportunity to expand on the 
> objectives if you like, espcially since we've haven't 
> received any comments during WGLC so far, and I can't submit 
> the Objectives draft to the IESG until after the IETF 63 meeting.
> 
> Additionally, the evaluation team will report on their 
> findings and release their draft at the IETF meeting.  You 
> can also raise these points with the evaluation team, during 
> the meeting if you are attending, or on the WG list when the 
> WG has a chance to comment.  They have done an excellent job so far.
> 
> As we finalize the evaluation process and protocol, the WG 
> will have an opportunity to further refine the protocol to 
> address comments such as yours.
> 
> Thanks,
> Dorothy
>  
>