Subject: [Capwap] Radius

From: [email-masked]
Date: Thu, 02 Feb 2006 19:18:30 +0000

I was wondering if it really makes sense in the NON split MAC case to 
require the AC handle radius requests.  It seems this is over burdening 
the AC.  The LWAPP protocol should allow the AC to configure the radius 
server.

regards,

Philip

_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap

Archives: http://lists.frascone.com/pipermail/capwap

---

From: [email-masked]
Date: Thu, 02 Feb 2006 19:28:25 +0000

I would like to go back to my request for an additional message to find 
out the ssid.  I think the spec could be enhanced to allow an OPTIONAL 
get_wlan_config message from the AC to the WTP.  This would occur after 
the join.  This would then allow the AC to know all the information 
that is configured in the AP since there already is a get_config 
message.

Opinions ?

Philip

---

From: Charles Clancy <[email-masked]>
Date: Fri, 03 Feb 2006 22:03:53 -0500

Are you suggesting the WTPs communicate directly with the AAA server, 
and the AC configures the WTPs with the appropriate connection 
information?  Two thoughts:

1. AAA traffic is trivial compared to everything else the AC will be 
doing, so the performance increase would be minimal.

2. You've broken the keying/trust hierarchy.  Now compromise of a single 
WTP would allow an attacker the ability to compromise all networks that 
AAA server manages.  You can't contain attacks anymore.

[ t. charles clancy ]--[ [email-masked] ]--[ www.cs.umd.edu/~clancy ]
[ computer science ]-----[ university of maryland | college park ]

---

From: [email-masked]
Date: Tue, 07 Feb 2006 17:59:54 +0000

My reading of the draft indicates there are 2 modes of operation.

a) Combined MAC (where the AP does everything)
b) Split MAC (where the AC does most of the work)

in case b) it is clear that the AC must act as the radius relay.

in case a) where the AC is just configuring the WTP, it is not clear 
WHY the AC has to 'proxy' as the radius server.  I think the 
restriction on REQUIRING that the AC act as the radius server (in base 
a) is too strong.

Philip

Quoting Charles Clancy <[email-masked]>:

> 2. You've broken the keying/trust hierarchy.  Now compromise of a 
> single WTP would allow an attacker the ability to compromise all 
> networks that AAA server manages.  You can't contain attacks anymore.
>
>> I was wondering if it really makes sense in the NON split MAC case 
>> to require the AC handle radius requests.  It seems this is over 
>> burdening the AC.  The LWAPP protocol should allow the AC to 
>> configure the radius server.
>>
>> regards,
>>
>> Philip
>>

---

From: "David T. Perkins" <[email-masked]>
Date: Tue, 7 Feb 2006 10:18:31 -0800 (PST)

HI,

Where do you draw the line between:
1) a collection of stand-alone APs that have a management
   application apply a consistent configuration
2) a collection an AC and connected WTPs that
   act together as a system.

I believe that this is an important issue, because #1 does
not need the CAPWAP protocol. It can use the existing mangement
interfaces (be they CLI, SNMP, or proprietary) found on
standalone APs. And these interfaces can be different.
That is, AP #1 could be managed via scripted CLI commands,
and AP #2 could be managed via SNMP operations.

Regards,
/david t. perkins