Subject: [Capwap] Issue 155: WTP/AC ACL Synchronization Issue

From: "Pat Calhoun (pacalhou)" <[email-masked]>
Date: Tue, 29 Jul 2008 08:56:22 -0700

Pasi's comment was:

   The protocol allows the AC to add and delete static MAC ACL entries,
but it 
   seems the AC can't check what the current ACL entries are.
   This means the WTP and AC could get out-of-sync, right? (The AC can't
delete 
   the unneeded static MAC ACL entries if it doesn't know what they
are.)

Well.... When a WTP comes up, it provides its configuration to the AC,
and at that point it would include its ACL table. Sure, I guess an AC
could have a bug and "forget" what the WTP provided - but I'm not sure
we should be addressing poor programming practices through standards.

I would recommend we reject this comment.

PatC
_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap

Archives: http://lists.frascone.com/pipermail/capwap

---

From: "Nathan J. Williams" <[email-masked]>
Date: Tue, 29 Jul 2008 12:37:10 -0400

"Pat Calhoun (pacalhou)" <[email-masked]> writes:

> and at that point it would include its ACL table.

Does it? I don't think the protocol has a message for communicating that
state, and there certainly isn't one required or permitted in the
Configuration Status message.

Rereading around this, I'm reminded that the MAC ACL definition, at
least as far as it can be understood from the add/remove message
elements, is a little weird. It's a blacklist, and describing that as an
ACL seems odd. As a blacklist, I would expect it to be empty by default,
but that doesn't help the fact that the AC doesn't know the existing set
of static entries.

	- Nathan

---

From: <[email-masked]>
Date: Tue, 29 Jul 2008 19:03:51 +0300

> I would recommend we reject this comment.

If the Configuration Status Request message included the static ACL
table, that would work -- but I can't find anything in the current
spec about sending the ACL table in this message.

Best regards,
Pasi

---

From: "Pat Calhoun (pacalhou)" <[email-masked]>
Date: Thu, 31 Jul 2008 14:43:34 -0700

Sorry for the delay, had to talk to some of the developers to make sure
that I understood what was going on.

So, first, yes, this is a blacklist, and not an ACL. I think we opted to
use the term ACL vs. blacklist because of it is less offensive to some. 

Second, the way it works is that the AC *always* sends an updated list
to the WTP at reboot. However, some WTPs *could* conceptually operate
without an AC (such as the case where the WAN link between the WTP and
the AC is down). Obviously, such WTPs could only operate this way when
configured for Local mode. Split mode requires an AC.

So the WTP stores the ACL, and can use it even if it reboots and it is
unable to connect to the AC. However, it always gets an updated list
from the AC when it does connect.

So... Given that we've never discussed the concept of a WTP operating
without an AC, does it really make sense to leave this functionality in
the spec? I think we should pull out the Add/Delete Static message
elements, and deal with this in a future rev of the spec if the need
arises (because it will likely require more than just some verbage here
and there).

Thoughts?

PatC 

-----Original Message-----
From: Nathan J. Williams [mailto:[email-masked]] 
Sent: Tuesday, July 29, 2008 9:37 AM
To: Pat Calhoun (pacalhou)
Cc: [email-masked]; [email-masked]
Subject: Re: [Capwap] Issue 155: WTP/AC ACL Synchronization Issue

"Pat Calhoun (pacalhou)" <[email-masked]> writes:

>    The protocol allows the AC to add and delete static MAC ACL 
> entries, but it
>    This means the WTP and AC could get out-of-sync, right? (The AC 
> can't delete

	- Nathan