Subject: [Capwap] BSSID-WLAN mappings

From: Puneet <[email-masked]>
Date: Fri, 14 Apr 2006 00:28:36 -0700

the BSSID description in Section 11.9.1 'WTP Radio Configuration' notes that
a WTP that supports 16 WLANS MUST have 16 MAC addresses reserved for it.
Why? ie. what part of the protocol does not work if we have multiple SSIDs
on a single BSSID? (whether thats good design or bad is a different matter).
Since the WLAN ID could be used in all such places to convey WLAN
information back to the AC, why do we need to mandate this 1:1 BSSID-WLAN
mapping?

Thanks,
Puneet
_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap

Archives: http://lists.frascone.com/pipermail/capwap

---

From: "Partha Narasimhan" <[email-masked]>
Date: Fri, 14 Apr 2006 09:58:52 -0700

I agree. Here is one more reason why the WLAN ID to BSSID mapping should
be determined by the WTP and not be mandated by the protocol. And we
should not exclude implementations that can map multiple SSIDs onto a
single BSSID.

Thanks

partha

________________________________

From: Puneet [mailto:[email-masked]] 
Sent: Friday, April 14, 2006 12:29 AM
To: [email-masked]
Subject: [Capwap] BSSID-WLAN mappings

the BSSID description in Section 11.9.1 'WTP Radio Configuration' notes
that a WTP that supports 16 WLANS MUST have 16 MAC addresses reserved
for it. Why? ie. what part of the protocol does not work if we have
multiple SSIDs on a single BSSID? (whether thats good design or bad is a
different matter). Since the WLAN ID could be used in all such places to
convey WLAN information back to the AC, why do we need to mandate this
1:1 BSSID-WLAN mapping?

Thanks,
Puneet

---

From: "Saravanan Govindan" <[email-masked]>
Date: Tue, 18 Apr 2006 08:58:09 +0800

Hi Puneet,

I agree that the CAPWAP should not exclude any particular
implementation. However, the fact remains that the shared deployment
scenario is a mandatory requirement for the protocol. 

There was a note from one of the IESG reviewers about giving due
importance to service provider concerns in the CAPWAP Objectives; we had
to change the sequence in which service provider requirements were
presented in that document so as not to imply lesser value! 

So I think it is important that the CAPWAP specifications be consistent
with the requirements that were reviewed. 

Cheers,

Saravanan

 

From: Puneet [mailto:[email-masked]] 
Sent: Monday, April 17, 2006 7:47 AM
To: Saravanan Govindan
Cc: [email-masked]
Subject: Re: [Capwap] BSSID-WLAN mappings

Hi Saravanan,

I see your point, but this seems to address a very specific deployment
scenario (service providers sharing WLAN equipment). If nothing else in
the CAPWAP messages is dependent on this, then this should be a
recommendation instead of a mandate. That way the protocol remains
inclusive, and also meets its objective.

I think it is very important that existing implementations are not
excluded just because they dont seem to meet one specific need in a
specific deployment scenario.

Thanks,
Puneet

On 4/15/06, Saravanan Govindan <[email-masked]> wrote:

Hi Puneet,

My concern regarding the BSSID - WLAN mapping is based on the mandatory
Objective "Logical Groups" (Section 5.1.1 of CAPWAP Objectives).

The Objective requires that WTP traffic be kept logically distinct among

logical groups. This arises from the commercial need of service
providers
sharing WLAN infrastructure equipment. Service providers want their
traffic
to be distinguished both over the wireless environment (e.g. BSSIDS) and

over the AC-WTP environment (e.g. WLANs).

The BSSID-WLAN mapping issue is the technical requirement coming from
this
commercial need. It allows an AC - or WTP - to decide how logical groups
are
separated over the wireless and AC-WTP segments. So by making this
mapping, 
CAPWAP frames of different logical groups (WLANs) can be distinctly
exchanged.

I agree with others that this mapping should not exclude any
implementation
- my concern is that the mapping be including in the first place. 

Cheers,

Saravanan

>  ------------------------------
> *From:* Puneet [mailto:[email-masked]]
> *Sent:* Friday, April 14, 2006 12:29 AM 
> *To:* [email-masked]
> *Subject:* [Capwap] BSSID-WLAN mappings
>
for 
> it. Why? ie. what part of the protocol does not work if we have
multiple
> SSIDs on a single BSSID? (whether thats good design or bad is a
different
> matter). Since the WLAN ID could be used in all such places to convey 
WLAN

_________________________________________________________________
Get an advanced look at the new version of MSN Messenger. 
http://messenger.msn.com.sg/Beta/Default.aspx

---

From: "Bob O'Hara (boohara)" <[email-masked]>
Date: Fri, 28 Apr 2006 12:34:40 -0700

The mechanism below is, of course, not compliant with the 802.11
standard.  It is a proprietary extension.  It is not clear to me why
CAPWAP should support this mechanism, or any other proprietary
mechanism.  As Jeff points out below, this is not compatible with all
clients (most likely because the mechanism is not mentioned in the
standard) and also violates the security assumptions of 802.11.

 -Bob

From: Jeff Joslin [mailto:[email-masked]] 
Sent: Friday, April 28, 2006 12:19 PM
To: [email-masked]
Subject: RE: [Capwap] BSSID-WLAN mappings

You can implement multiple SSID with single BSSID by having only one
SSID in the beacon; the others SSIDs are hidden. If a client broadcasts
a probe for one of those hidden SSIDs the AP will respond and the client
can then do a normal association. The AP maintains one
broadcast/multicast key for each encryption type (WEP, TKIP, AES) and
uses the appropriate one according to the encryption type of the frame's
SSID. This allows a certain amount of information leakage between SSIDs,
but in most applications this is acceptable.

The above scheme works, after a fashion, but creates some client
compatibility issues. Multiple BSSID is preferable.

One SSID == 1 WLAN. In general we cannot assume that 1 BSSID == 1 WLAN.

Perhaps 1 VLAN == 1 WLAN is more helpful? It is standard practice to map
each SSID to a separate VLAN.

Jeff Joslin

Senior Network Architect

BelAir Networks

From: Pat Calhoun (pacalhou) [mailto:[email-masked]] 
Sent: 28 April 2006 2:57 PM
To: Puneet; Bob O'Hara (boohara)
Cc: [email-masked]
Subject: RE: [Capwap] BSSID-WLAN mappings

Well, first, there is no way that I am aware of where you can have
multiple SSIDs for a single BSSID. Furthermore, if one were to do this,
how would you handle broadcast packet encryption, where a station would
see packets from a BSSID, but would not be able to decrypt it -
presumably because the AC would have multiple GTKs, not indexed on a
BSSID, but some other non-defined mechanism.

I contend 1 BSSID == 1 WLAN.

Pat Calhoun
CTO, Wireless Networking Business Unit
Cisco Systems

	From: Puneet [mailto:[email-masked]] 
	Sent: Monday, April 17, 2006 10:39 AM
	To: Bob O'Hara (boohara)
	Cc: [email-masked]
	Subject: Re: [Capwap] BSSID-WLAN mappings

	Bob,
	
	> We should not be implementing, or requiring an CAPWAP
implementation to implement a method 
	> that lowers the security of the WLAN.
	
	I am not sure I understand the argument here: supporting open or
WEP also does the same thing, but CAPWAP supports those encryption
protocols. CAPWAP does not force everyone to support WEP, but it
*allows* it to be setup on a WLAN. Along the same lines we should allow
this mapping too. Maybe make a note that it does not allow WLAN traffic
separation into logical groups over the air (Saravanans point)
	
	Thanks,
	Puneet

	On 4/17/06, Bob O'Hara (boohara) <[email-masked]> wrote: 

	There are also security issues when there is not a 1:1 mapping
of WLAN to BSSID.  Without this restriction, a station will not have any
assurance that traffic it believes is encrypted and protected according
to the policy of the WLAN to which it is associated is not being
decrypted by an oracle (the AP) and rebroadcast to other stations
without the same requirements for abiding with the same security
policies.

	We should not be implementing, or requiring an CAPWAP
implementation to implement a method that lowers the security of the
WLAN.

	 -Bob

	

	From: Puneet [mailto: [email-masked]
<mailto:[email-masked]> ] 

	Sent: Sunday, April 16, 2006 4:47 PM
	To: Saravanan Govindan
	Cc: [email-masked]
	Subject: Re: [Capwap] BSSID-WLAN mappings

	Hi Saravanan,
	
	I see your point, but this seems to address a very specific
deployment scenario (service providers sharing WLAN equipment). If
nothing else in the CAPWAP messages is dependent on this, then this
should be a recommendation instead of a mandate. That way the protocol
remains inclusive, and also meets its objective.
	
	I think it is very important that existing implementations are
not excluded just because they dont seem to meet one specific need in a
specific deployment scenario.
	
	Thanks,
	Puneet

	Hi Puneet,
	
	My concern regarding the BSSID - WLAN mapping is based on the
mandatory
	Objective "Logical Groups" (Section 5.1.1 of CAPWAP Objectives).
	
	The Objective requires that WTP traffic be kept logically
distinct among 
	logical groups. This arises from the commercial need of service
providers
	sharing WLAN infrastructure equipment. Service providers want
their traffic
	to be distinguished both over the wireless environment (e.g.
BSSIDS) and 
	over the AC-WTP environment (e.g. WLANs).
	
	The BSSID-WLAN mapping issue is the technical requirement coming
from this
	commercial need. It allows an AC - or WTP - to decide how
logical groups are
	separated over the wireless and AC-WTP segments. So by making
this mapping, 
	CAPWAP frames of different logical groups (WLANs) can be
distinctly
	exchanged.
	
	I agree with others that this mapping should not exclude any
implementation
	- my concern is that the mapping be including in the first
place. 
	
	Cheers,
	
	Saravanan

	
	> that a WTP that supports 16 WLANS MUST have 16 MAC addresses
reserved for 
	> it. Why? ie. what part of the protocol does not work if we
have multiple
	> SSIDs on a single BSSID? (whether thats good design or bad is
a different
	WLAN

	

	
_________________________________________________________________
	To unsubscribe or modify your subscription options, please
visit:
	http://lists.frascone.com/mailman/listinfo/capwap

---

From: "Jeff Joslin" <[email-masked]>
Date: Fri, 28 Apr 2006 15:46:35 -0400

Indeed, the M-SSID mechanism I described is not in the standard but has
been implemented by a number of different vendors, including, as I
recall, Cisco Aironet. Now that 802.11 chip sets and drivers have better
support for M-BSSID, there is little reason to use the more problematic
M-SSID. Its only advantage over M-BSSID is that M-SSID uses up fewer MAC
addresses.

Jeff

  _____  

From: Bob O'Hara (boohara) [mailto:[email-masked]] 
Sent: 28 April 2006 3:35 PM
To: [email-masked]
Subject: RE: [Capwap] BSSID-WLAN mappings

 -Bob

  _____  

Jeff Joslin

Senior Network Architect

BelAir Networks

  _____  

Pat Calhoun

  _____  

	Bob,

	
	Thanks,
	Puneet

	 -Bob

	
  _____  

	Hi Saravanan,

	
	Thanks,
	Puneet

	Hi Puneet,

	

	Cheers,
	
	Saravanan

	
reserved for 
have multiple
a different
	WLAN

---

From: "Pat Calhoun (pacalhou)" <[email-masked]>
Date: Fri, 28 Apr 2006 11:56:37 -0700

Pat Calhoun

	Bob,

	
	Thanks,
	Puneet

		There are also security issues when there is not a 1:1
mapping of WLAN to BSSID.  Without this restriction, a station will not
have any assurance that traffic it believes is encrypted and protected
according to the policy of the WLAN to which it is associated is not
being decrypted by an oracle (the AP) and rebroadcast to other stations
without the same requirements for abiding with the same security
policies.

		 -Bob

		
		Hi Saravanan,
		
		I see your point, but this seems to address a very
specific deployment scenario (service providers sharing WLAN equipment).
If nothing else in the CAPWAP messages is dependent on this, then this
should be a recommendation instead of a mandate. That way the protocol
remains inclusive, and also meets its objective.
		
		I think it is very important that existing
implementations are not excluded just because they dont seem to meet one
specific need in a specific deployment scenario.
		
		Thanks,
		Puneet

		On 4/15/06, Saravanan Govindan <[email-masked]>
wrote: 

			Hi Puneet,
			
			My concern regarding the BSSID - WLAN mapping is
based on the mandatory
			Objective "Logical Groups" (Section 5.1.1 of
CAPWAP Objectives).
			
			The Objective requires that WTP traffic be kept
logically distinct among 
			logical groups. This arises from the commercial
need of service providers
			sharing WLAN infrastructure equipment. Service
providers want their traffic
			to be distinguished both over the wireless
environment (e.g. BSSIDS) and 
			over the AC-WTP environment (e.g. WLANs).
			
			The BSSID-WLAN mapping issue is the technical
requirement coming from this
			commercial need. It allows an AC - or WTP - to
decide how logical groups are
			separated over the wireless and AC-WTP segments.
So by making this mapping, 
			CAPWAP frames of different logical groups
(WLANs) can be distinctly
			exchanged.
			
			I agree with others that this mapping should not
exclude any implementation
			- my concern is that the mapping be including in
the first place. 
			
			Cheers,
			
			Saravanan

			
			> that a WTP that supports 16 WLANS MUST have 16
MAC addresses reserved for 
			> it. Why? ie. what part of the protocol does
not work if we have multiple
			> SSIDs on a single BSSID? (whether thats good
design or bad is a different
			WLAN
			> Archives:
http://lists.frascone.com/pipermail/capwap

_________________________________________________________________ 
			Get an advanced look at the new version of MSN
Messenger. 
			http://messenger.msn.com.sg/Beta/Default.aspx 

_________________________________________________________________
		To unsubscribe or modify your subscription options,
please visit:
		http://lists.frascone.com/mailman/listinfo/capwap

---

From: "Bob O'Hara (boohara)" <[email-masked]>
Date: Fri, 28 Apr 2006 13:38:23 -0700

As I said, this is a proprietary extension, even if it might have been
provided on some Cisco products.  I hold that CAPWAP is chartered to
implement a protocol to support 802.11, not the myriad proprietary
extension that have been hammered onto its side over the years.
 
But, the more damning problem for this is the lowering of security and
the violation of the security assumptions on which 802.11i is based.
Crossing the boundary of a security domain, even if "only" for
multicast, dramatically increases the opportunity for compromise of data
that communicants believe is secure.

 -Bob

From: Jeff Joslin [mailto:[email-masked]] 
Sent: Friday, April 28, 2006 12:47 PM
To: Bob O'Hara (boohara); [email-masked]
Subject: RE: [Capwap] BSSID-WLAN mappings

Jeff

 -Bob

Jeff Joslin

Senior Network Architect

BelAir Networks

Pat Calhoun

	Bob,

	
	Thanks,
	Puneet

	 -Bob

	

	Hi Saravanan,

	
	Thanks,
	Puneet

	Hi Puneet,

	

	Cheers,
	
	Saravanan

	
reserved for 
have multiple
a different
	WLAN

---

From: "Jeff Joslin" <[email-masked]>
Date: Fri, 28 Apr 2006 16:52:48 -0400

I agree that CAPWAP need not support M-SSID, particularly given the
security implications.

Jeff

  _____  

From: Bob O'Hara (boohara) [mailto:[email-masked]] 
Sent: 28 April 2006 4:38 PM
To: Jeff Joslin; [email-masked]
Subject: RE: [Capwap] BSSID-WLAN mappings

 -Bob

  _____  

Jeff

  _____  

 -Bob

  _____  

Jeff Joslin

Senior Network Architect

BelAir Networks

  _____  

Pat Calhoun

  _____  

	Bob,

	
	Thanks,
	Puneet

	 -Bob

	
  _____  

	Hi Saravanan,

	
	Thanks,
	Puneet

	Hi Puneet,

	

	Cheers,
	
	Saravanan

	
reserved for 
have multiple
a different
	WLAN

---

From: "Scott G. Kelly" <[email-masked]>
Date: Fri, 28 Apr 2006 17:22:32 -0400 (EDT)

I agree with Bob - this is unacceptable from a security perspective.

-----Original Message-----
>From: "Bob O'Hara (boohara)" <[email-masked]>
>Sent: Apr 28, 2006 4:38 PM
>To: Jeff Joslin <[email-masked]>, [email-masked]