Subject: RE: [Capwap] FW: COMMENT: draft-ietf-capwap-objectives

From: "Pat Calhoun (pacalhou)" <[email-masked]>
Date: Thu, 16 Feb 2006 08:39:22 -0800

I agree with all of the proposals below.

Pat Calhoun
CTO, Wireless Networking Business Unit
Cisco Systems

> -----Original Message-----
> From: T. Charles Clancy [mailto:[email-masked]] 
> Sent: Thursday, February 16, 2006 8:02 AM
> To: Mani, Mahalingam (Mani)
> Cc: [email-masked]
> Subject: Re: [Capwap] FW: COMMENT: draft-ietf-capwap-objectives
> 
> >>   Protocol Requirement:
> >>
> >>   The CAPWAP protocol MUST support mutual authentication 
> of WTPs and
> >>   the centralized controller.  It must also ensure that information
> >>   exchanges between them are secured.
> >
> > Does that mean encrypted or only integrity-protected?
> 
> I think we meant at least integrity protected.  Suggest:
> 
> The CAPWAP protocol MUST support mutual authentication of 
> WTPs and the centralized controller.  It also MUST ensure 
> that information exchanges are integrity protected, and 
> SHOULD ensure confidentiality through encryption."
> 
> >>   Protocol Requirement:
> >>
> >>   The design of the CAPWAP protocol MUST NOT allow for any 
> compromises
> >>   to the WLAN system by external entities.
> >
> > Strange phrasing. Suggestion:
> >
> >   The design of the CAPWAP protocol MUST protect against any
> >   compromises of the WLAN system by external entities.
> 
> Seems reasonable to me.
> 
> [ t. charles clancy ]--[ [email-masked] ]--[ 
> www.cs.umd.edu/~clancy ] [ computer science ]-----[ 
> university of maryland | college park ] 
> _________________________________________________________________
> To unsubscribe or modify your subscription options, please visit:
> http://lists.frascone.com/mailman/listinfo/capwap
> 
> Archives: http://lists.frascone.com/pipermail/capwap
> 
_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap

Archives: http://lists.frascone.com/pipermail/capwap

---

From: "Saravanan Govindan" <[email-masked]>
Date: Fri, 17 Feb 2006 17:12:40 +0800

Hi Dave,

I think it would be best to provide the same level of security services
to all the three types of exchanges you mention below. 

In particular, for WLAN client traffic, there are cases where 11i
terminates at the WTP. And since WLAN client traffic is tunneled in
CAPWAP data frames to the AC, these CAPWAP data will have to be secured
also. So all types of exchanges will require the same security services.

The mirror case also exists. When 11i terminates at the AC, WLAN client
traffic will continue to be secured between the WTP and AC. So in this
case, CAPWAP data exchanges may not require the same level of security
services as CAPWAP control exchanges. 

Saravanan

-----Original Message-----
From: David T. Perkins [mailto:[email-masked]] 
Sent: Friday, February 17, 2006 3:46 AM
To: T. Charles Clancy
Cc: [email-masked]
Subject: Re: [Capwap] FW: COMMENT: draft-ietf-capwap-objectives

HI,

Sorry if this is answered by context....

CAPWAP consists of
1) control messages (actions, configuration, status, and statistics)
2) tunneling of WLAN client traffic
3) system image transfer from an AC to WTPs

Are the same security services needed for all operations?
And can there be different security services provided
for, say, CAPWAP control messages than tunnelled WLAN client
traffic?

On Thu, 16 Feb 2006, T. Charles Clancy wrote:
> >>   Protocol Requirement:
> >>
> >>   The CAPWAP protocol MUST support mutual authentication of WTPs
and
> The CAPWAP protocol MUST support mutual authentication of WTPs and the

> centralized controller.  It also MUST ensure that information
exchanges 
> are integrity protected, and SHOULD ensure confidentiality through 
> encryption."
> 
> >>   Protocol Requirement:
> >>
compromises
> [ t. charles clancy ]--[ [email-masked] ]--[ www.cs.umd.edu/~clancy ]
> [ computer science ]-----[ university of maryland | college park ]

Regards,
/david t. perkins