Subject: RE: [Fwd: [L2tpext] Tunneling for Wireless LAN Authentication]

From: "Glen Zorn" <[email-masked]>
Date: Tue, 10 Dec 2002 17:12:44 -0800

"Mike Moreton" <[email-masked]> writes:

> All,
>
>
>
> I don?t know if anyone can help me here?
>
>
>
> The IEEE is working on enhancements to the security features of its
> 802.11 wireless LAN technology.  One of the features of this is an
> authentication mechanism based on 802.1X EAPOL frames.  In certain
> circumstances these can transit a bridged network to Access Points
> different to the one with which the wireless client is currently
> associated.
>
>
>
> However, as the IEEE only works on level 2 standards, there are no
> mechanisms for reaching a remote AP not on the subnet, even should its
> IP address be known by ?some other mechanism?.  It would be nice to make
> a suggestion about the technique to be used, even if the IEEE couldn?t
> lay down a formal standard.
>
>
>
> One obvious solution would be to tunnel the EAPOL frames to the remote
> AP inside some sort of IP based protocol (in the case of an IP
> network).  It appears that PPP can do that, but PPP is probably much to
> complex in order just to get a few (unprotected) frames across.  RFC3378
> describes a very simple encapsulation, but it sounds as if ?helpful?
> routers along the way might de-encapsulate the frames, which is
> definitely not what is required.  What is needed is an end-to-end
> encapsulation.
>
>
>
> Can anyone help?

Ignoring much of the nonsense therein, EAP over UDP
(draft-engelstad-pana-eap-over-udp-00.txt) might work.  How about Ethernet
(or 802.11, if you prefer) over L2TPv3?

>
>
>
> Mike.
>
>
>
> Mike Moreton, Synad Technologies.
>
>
>
>
>
>
>
>

_______________________________________________
L2tpext mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/l2tpext

---

From: "Glen Zorn" <[email-masked]>
Date: Tue, 10 Dec 2002 17:12:44 -0800

---

From: "W. Mark Townsley" <[email-masked]>
Date: Wed, 11 Dec 2002 09:49:01 +0100

>>definitely not what is required.  What is needed is an end-to-end

I think that the crux of this issue is the chicken-and-egg problem of 802.1X 
EAPOL providing ethernet (e.g. L2) authorization, while IP clearly requires L2 
connectivity for it to operate (at L3). Thus, even if your IP addresses are 
known by "some other mechanism" (not speculating what that mechanism is) then 
you clearly need to have L2 enabled between them to communicate, at least for 
the packets carrying your EAP-in-IP packets (or EAPOL-in-something-in-IP 
packets). The intermingling of layers here seems to suggest the possibility of 
at least some hit to the IEEE protocols, as well as associated security 
implications, for passing "these few" EAP-in-IP frames before actually 
authorizing the link fully via EAPOL.

> (or 802.11, if you prefer) over L2TPv3?

L2TPv3 would certainly work for transportation of 802.1X frames, but this also 
could be considered an undue amount of functionality for just a few auth frames.

Assuming you knew the IP addresses of the boxes you wanted to transport 802.1X 
frames between, just sending them as you suggest seems the simplest solution 
(over UDP as well as anything else). draft-engelstad-pana-eap-over-udp-00.txt is 
the right idea in name, though the draft does seem to have a lot more text 
within than I would, at first stroke, think necessary here (It's also expired).

- Mark

---

From: "W. Mark Townsley" <[email-masked]>
Date: Wed, 11 Dec 2002 09:49:01 +0100

- Mark