Subject: [L2tpext] Tunneling for Wireless LAN Authentication

From: "Mike Moreton" <[email-masked]>
Date: Thu, 28 Nov 2002 13:09:30 -0000

All,

I don't know if anyone can help me here...

The IEEE is working on enhancements to the security features of its
802.11 wireless LAN technology.  One of the features of this is an
authentication mechanism based on 802.1X EAPOL frames.  In certain
circumstances these can transit a bridged network to Access Points
different to the one with which the wireless client is currently
associated.

However, as the IEEE only works on level 2 standards, there are no
mechanisms for reaching a remote AP not on the subnet, even should its
IP address be known by "some other mechanism".  It would be nice to make
a suggestion about the technique to be used, even if the IEEE couldn't
lay down a formal standard.

One obvious solution would be to tunnel the EAPOL frames to the remote
AP inside some sort of IP based protocol (in the case of an IP network).
It appears that PPP can do that, but PPP is probably much to complex in
order just to get a few (unprotected) frames across.  RFC3378 describes
a very simple encapsulation, but it sounds as if "helpful" routers along
the way might de-encapsulate the frames, which is definitely not what is
required.  What is needed is an end-to-end encapsulation.

Can anyone help?

Mike.

Mike Moreton, Synad Technologies.