Subject: [Capwap] New Issue: DOT1X Port Access Control Missing

From: "Pat Calhoun (pacalhou)" <[email-masked]>
Date: Wed, 9 May 2007 21:11:23 -0700

All,

I believe that the current IEEE 802.11 binding document does not
currently describe the division of 802.1X labor properly across the AC
and the WTP. The current text lists IEEE 802.1X/EAP, but that is just
one component of the 802.1X protocol. For instance, figure 1 currently
includes:

       IEEE 802.11 RSN
            IEEE 802.1X/EAP                           AC
            RSNA Key Management                       AC
            IEEE 802.11 Encryption/Decryption         WTP/AC

I would propose to split up the IEEE 802.1X/EAP function into two
separate functions; IEEE 802.1X State Machine/EAP and IEEE 802.1X Port
Access Control. The following are my proposed changes:

2.1.1.  Split MAC
[...]

       IEEE 802.11 RSN
            IEEE 802.1X State Machine/EAP             AC
            IEEE 802.1X Port Access Control           WTP/AC
            RSNA Key Management                       AC
            IEEE 802.11 Encryption/Decryption         WTP/AC

I would changing the following paragraph from:
<existing text>
   All remaining IEEE 802.11 MAC management frames are supported on the
   AC, including the Association Request frame which allows the AC to be
   involved in the access policy enforcement portion of the IEEE 802.11
   protocol.  The IEEE 802.1X and IEEE 802.11 key management function
   are also located on the AC.  This implies that the AAA client also
   resides on the AC.
</existing text>
To:
<proposed text>
   All remaining IEEE 802.11 MAC management frames are supported on the
   AC, including the Association Request frame which allows the AC to be
   involved in the access policy enforcement portion of the IEEE 802.11
   protocol.  The IEEE 802.1X state machine and IEEE 802.11 key
   management function are also located on the AC.  This implies that
   the AAA client also resides on the AC. The 802.1X port access control
   resides in the same location as the IEEE 802.11
Encryption/Decryption.
</proposed text>

And 

2.1.2.  Local MAC
[...]

       IEEE 802.11 RSN
            IEEE 802.1X State Machine/EAP             AC
            IEEE 802.1X Port Access Control           WTP
            RSNA Key Management                       AC
            IEEE 802.11 Encryption/Decryption         WTP

While changing the following paragraph from:
<current text>
   The IEEE 802.1X and RSNA Key Management functions reside in the AC.
   Therefore, the WTP MUST forward all IEEE 802.1X/RSNA Key Management
   frames to the AC and forward the corresponding responses to the
   station.  This implies that the AAA client also resides on the AC.	
</current text>
To:
<Proposed text>
   The IEEE 802.1X State Machine and RSNA Key Management functions
   reside in the AC. Therefore, the WTP MUST forward all IEEE
   802.1X/RSNA Key Management frames to the AC and forward the
   corresponding responses to the station.  This implies that the
   AAA client also resides on the AC. The IEEE 802.1X Port Access
   Control function resides in the WTP.	
</Proposed text>

Comments?

PatC
_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap

Archives: http://lists.frascone.com/pipermail/capwap

---

From: "Charles Clancy" <[email-masked]>
Date: Thu, 10 May 2007 00:32:49 -0400 (EDT)

Sounds okay to me, though I'm not entirely sure it's necessary.  I guess
it just clearly states what was implied by the previous text.

No objections from me.

-- 
t. charles clancy, ph.d.  <>  [email-masked]  <>  www.cs.umd.edu/~clancy