Subject: [Capwap] One issue "In order to support NAT, I recommend that LWAPP only support one UDP port for Control tunnel and Data Tunnel"

From: zhaoyujin 31390 <[email-masked]>
Date: Mon, 27 Feb 2006 09:59:28 +0500

Dear all:

  I recommend that LWAPP only support one UDP port for Control tunnel and Data Tunnel. 

  LWAPP protocol uses UDP packets, so that it can directly support NAT passthrough.

  One basic scenario is that WTP is behind NAT device and AC is in public network. For control tunnel, there are no problem. Because it is initiated by WTP, NAT device can create corresponding table for LWAPP control tunnel packets. 

  The problems is:

   1. The data packets can not be firstly sent from AC to WTP.

   2. Even if WTP firstly sends pacekts, AC can get the corresponding control tunnel with this LWAPP data tunnel based on the packets.  Because in one NAT device, there may be multiple WTP. All WTP's IP addresses are same which is NAT device global IP address, and AC can not know the data packets belonging to which AP.

Best regards
Yujin Zhao
H3Com

_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap

Archives: http://lists.frascone.com/pipermail/capwap

---

From: "T. Charles Clancy" <[email-masked]>
Date: Mon, 27 Feb 2006 10:23:26 -0500 (EST)

You bring up a good point, but I think it can be addressed without 
requiring the use of a single UDP port.  In particular, during the DTLS 
handshake, authentication will occur.  Using the authentication 
information, the AC can then associate the DTLS control port with the data 
port.

Some additional text will likely be required to make this association 
explicit... in particular there will need to be some form of WTP identity 
in common between the DTLS ClientHello, and the CAPWAP Discovery Request.

[ t. charles clancy ]--[ [email-masked] ]--[ www.cs.umd.edu/~clancy ]
[ computer science ]-----[ university of maryland | college park ]

On Mon, 27 Feb 2006, zhaoyujin 31390 wrote:

> One basic scenario is that WTP is behind NAT device and AC is in public 
> network. For control tunnel, there are no problem. Because it is 
> initiated by WTP, NAT device can create corresponding table for LWAPP 
> control tunnel packets.
>
> The problems is:
>
>  2. Even if WTP firstly sends pacekts, AC can get the corresponding 
> control tunnel with this LWAPP data tunnel based on the packets. 
> Because in one NAT device, there may be multiple WTP. All WTP's IP 
> addresses are same which is NAT device global IP address, and AC can not 
> know the data packets belonging to which AP.
>
>
> Best regards
> Yujin Zhao
> H3Com
>

---

From: "David T. Perkins" <[email-masked]>
Date: Mon, 27 Feb 2006 19:21:28 -0800 (PST)

HI,

CAPWAP with NATs has come up from time to time on this list,
and people have claimed that it is a "typical" or "basic"
scenario. I'm sorry, but I don't see it. Before the WG
spends time resolving this issue, I'd really like to see
STRONG justifications. That is, why would you deploy
a CAPWAP system split this way? And if CAPWAP didn't
support this NAT split, what would it cost you, or
what would you not be able to do?

>    2. Even if WTP firstly sends pacekts, AC can get the corresponding control tunnel with this LWAPP data tunnel based on the packets.  Because in one NAT device, there may be multiple WTP. All WTP…

Regards,
/david t. perkins