Subject: RE: [Capwap] BSSID-WLAN mappings

From: "Bob O'Hara (boohara)" <[email-masked]>
Date: Mon, 17 Apr 2006 10:06:21 -0700

There are also security issues when there is not a 1:1 mapping of WLAN
to BSSID.  Without this restriction, a station will not have any
assurance that traffic it believes is encrypted and protected according
to the policy of the WLAN to which it is associated is not being
decrypted by an oracle (the AP) and rebroadcast to other stations
without the same requirements for abiding with the same security
policies.
 
We should not be implementing, or requiring an CAPWAP implementation to
implement a method that lowers the security of the WLAN.

 -Bob

________________________________

From: Puneet [mailto:[email-masked]] 
Sent: Sunday, April 16, 2006 4:47 PM
To: Saravanan Govindan
Cc: [email-masked]
Subject: Re: [Capwap] BSSID-WLAN mappings

Hi Saravanan,

I see your point, but this seems to address a very specific deployment
scenario (service providers sharing WLAN equipment). If nothing else in
the CAPWAP messages is dependent on this, then this should be a
recommendation instead of a mandate. That way the protocol remains
inclusive, and also meets its objective.

I think it is very important that existing implementations are not
excluded just because they dont seem to meet one specific need in a
specific deployment scenario.

Thanks,
Puneet

On 4/15/06, Saravanan Govindan <[email-masked]> wrote: 

	Hi Puneet,
	
	My concern regarding the BSSID - WLAN mapping is based on the
mandatory
	Objective "Logical Groups" (Section 5.1.1 of CAPWAP Objectives).
	
	The Objective requires that WTP traffic be kept logically
distinct among 
	logical groups. This arises from the commercial need of service
providers
	sharing WLAN infrastructure equipment. Service providers want
their traffic
	to be distinguished both over the wireless environment (e.g.
BSSIDS) and 
	over the AC-WTP environment (e.g. WLANs).
	
	The BSSID-WLAN mapping issue is the technical requirement coming
from this
	commercial need. It allows an AC - or WTP - to decide how
logical groups are
	separated over the wireless and AC-WTP segments. So by making
this mapping, 
	CAPWAP frames of different logical groups (WLANs) can be
distinctly
	exchanged.
	
	I agree with others that this mapping should not exclude any
implementation
	- my concern is that the mapping be including in the first
place. 
	
	Cheers,
	
	Saravanan

	
	>  ------------------------------
	> *From:* Puneet [mailto:[email-masked]]
	> *Sent:* Friday, April 14, 2006 12:29 AM 
	> *To:* [email-masked]
	> *Subject:* [Capwap] BSSID-WLAN mappings
	>
	> the BSSID description in Section 11.9.1 'WTP Radio
Configuration' notes
	> that a WTP that supports 16 WLANS MUST have 16 MAC addresses
reserved for 
	> it. Why? ie. what part of the protocol does not work if we
have multiple
	> SSIDs on a single BSSID? (whether thats good design or bad is
a different
	> matter). Since the WLAN ID could be used in all such places to
convey 
	WLAN
	> information back to the AC, why do we need to mandate this 1:1
BSSID-WLAN
	> mapping?
	> Thanks,
	> Puneet
_________________________________________________________________ 
	> To unsubscribe or modify your subscription options, please
visit:
	> http://lists.frascone.com/mailman/listinfo/capwap
	>
	> Archives: http://lists.frascone.com/pipermail/capwap
	>

_________________________________________________________________
	Get an advanced look at the new version of MSN Messenger. 
	http://messenger.msn.com.sg/Beta/Default.aspx

_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap

Archives: http://lists.frascone.com/pipermail/capwap

---

From: Puneet <[email-masked]>
Date: Mon, 17 Apr 2006 10:38:59 -0700

Bob,

> We should not be implementing, or requiring an CAPWAP implementation to
implement a method
> that lowers the security of the WLAN.

I am not sure I understand the argument here: supporting open or WEP also
does the same thing, but CAPWAP supports those encryption protocols. CAPWAP
does not force everyone to support WEP, but it *allows* it to be setup on a
WLAN. Along the same lines we should allow this mapping too. Maybe make a
note that it does not allow WLAN traffic separation into logical groups over
the air (Saravanans point)

Thanks,
Puneet

On 4/17/06, Bob O'Hara (boohara) <[email-masked]> wrote:
>
> There are also security issues when there is not a 1:1 mapping of WLAN to
> BSSID.  Without this restriction, a station will not have any assurance that
> traffic it believes is encrypted and protected according to the policy of
> the WLAN to which it is associated is not being decrypted by an oracle (the
> AP) and rebroadcast to other stations without the same requirements for
> abiding with the same security policies.
>
> *Sent:* Sunday, April 16, 2006 4:47 PM
> *To:* Saravanan Govindan
> *Cc:* [email-masked]
> *Subject:* Re: [Capwap] BSSID-WLAN mappings
>
> Hi Saravanan,
>
> scenario (service providers sharing WLAN equipment). If nothing else in the
> CAPWAP messages is dependent on this, then this should be a recommendation
> instead of a mandate. That way the protocol remains inclusive, and also
> meets its objective.
>
> excluded just because they dont seem to meet one specific need in a specific
> deployment scenario.
>
> Thanks,
> Puneet
>
>
> > My concern regarding the BSSID - WLAN mapping is based on the mandatory
> > The Objective requires that WTP traffic be kept logically distinct among
> >
> > sharing WLAN infrastructure equipment. Service providers want their
> > traffic
> > to be distinguished both over the wireless environment (e.g. BSSIDS) and
> >
> > The BSSID-WLAN mapping issue is the technical requirement coming from
> > this
> > commercial need. It allows an AC - or WTP - to decide how logical groups
> > are
> > separated over the wireless and AC-WTP segments. So by making this
> > mapping,
> > CAPWAP frames of different logical groups (WLANs) can be distinctly
> > exchanged.
> >
> > - my concern is that the mapping be including in the first place.
> >
> > Cheers,
> >
> > Saravanan
> >
> >
> >
> >
> > > the BSSID description in Section 11.9.1 'WTP Radio Configuration'
> > notes
> > > that a WTP that supports 16 WLANS MUST have 16 MAC addresses reserved
> > for
> > > it. Why? ie. what part of the protocol does not work if we have
> > multiple
> > > SSIDs on a single BSSID? (whether thats good design or bad is a
> > different
> > > matter). Since the WLAN ID could be used in all such places to convey
> > WLAN