Subject: RE: [Capwap] Radius

From: Michael Montemurro <[email-masked]>
Date: Thu, 16 Mar 2006 12:57:19 -0500

I've created issue 83 as a bug to track this issue.

Cheers,

	Mike

> -----Original Message-----
> From: Pat Calhoun (pacalhou) [mailto:[email-masked]] 
> Sent: February 22, 2006 5:00 PM
> To: Charles Clancy; [email-masked]
> Cc: [email-masked]
> Subject: RE: [Capwap] Radius
> 
> Charles correctly interpreted my comment - and said it even 
> better than I did :)
> 
> Pat Calhoun
> CTO, Wireless Networking Business Unit
> Cisco Systems
> 
>  
> 
> > -----Original Message-----
> > From: Charles Clancy [mailto:[email-masked]]
> > Sent: Tuesday, February 21, 2006 4:47 PM
> > To: [email-masked]
> > Cc: Pat Calhoun (pacalhou); [email-masked]
> > Subject: Re: [Capwap] Radius
> > 
> > I don't think Pat's comments imply having only a split MAC.  
> > For example, local MAC with RADIUS client on the AC gives the added 
> > functionality of fast handoff between WTPs.
> > 
> > [ t. charles clancy ]--[ [email-masked] ]--[ 
> www.cs.umd.edu/~clancy ] [ 
> > computer science ]-----[ university of maryland | college park ]
> > 
> > Behcet Sarikaya wrote:
> > > If others agree, I also agree but reducing the scope to Split MAC 
> > > only, this is a big change!
> > > 
> > > Pat Calhoun (pacalhou) wrote:
> > > 
> > >> I believe that having CAPWAP focus on creating what we 
> essentially 
> > >> have today, via autonomous or standalone APs, is not 
> necessarily a 
> > >> worthwhile exercise.
> > >>
> > >> Pat Calhoun
> > >> CTO, Wireless Networking Business Unit Cisco Systems
> > >>
> > >>  
> > >>
> > >>     
> > --------------------------------------------------------------
> > ----------
> > >>     *From:* Behcet Sarikaya [mailto:[email-masked]]
> > >>     *Sent:* Sunday, February 19, 2006 2:35 PM
> > >>     *To:* Pat Calhoun (pacalhou)
> > >>     *Cc:* David T. Perkins; [email-masked];
> > >>     [email-masked]
> > >>     *Subject:* Re: [Capwap] Radius
> > >>
> > >>     I am confused, are you saying that local MAC WTPs
> > (with a Radius
> > >>     client) are not governed by CAPWAP work?
> > >>
> > >>     Behcet
> > >>
> > >>     Pat Calhoun (pacalhou) wrote:
> > >>
> > >>>I concur with David, and therefore having RADIUS in the 
> AP implies 
> > >>>that it is a standalone AP, and therefore not governed by
> > the CAPWAP work.
> > >>>
> > >>>Pat Calhoun
> > >>>CTO, Wireless Networking Business Unit Cisco Systems
> > >>>
> > >>> 
> > >>>
> > >>>  
> > >>>
> > >>>>-----Original Message-----
> > >>>>From: David T. Perkins [mailto:[email-masked]]
> > >>>>Sent: Tuesday, February 07, 2006 10:19 AM
> > >>>>To: [email-masked]
> > >>>>Cc: [email-masked]
> > >>>>Subject: Re: [Capwap] Radius
> > >>>>
> > >>>>HI,
> > >>>>
> > >>>>Where do you draw the line between:
> > >>>>1) a collection of stand-alone APs that have a management
> > >>>>   application apply a consistent configuration
> > >>>>2) a collection an AC and connected WTPs that
> > >>>>   act together as a system.
> > >>>>
> > >>>>I believe that this is an important issue, because #1
> > does not need
> > >>>>the CAPWAP protocol. It can use the existing mangement 
> interfaces 
> > >>>>(be they CLI, SNMP, or proprietary) found on standalone 
> APs. And 
> > >>>>these interfaces can be different.
> > >>>>That is, AP #1 could be managed via scripted CLI
> > commands, and AP #2
> > >>>>could be managed via SNMP operations.
> > >>>>
> > >>>>Regards,
> > >>>>/david t. perkins
> > >>>>
> > >>>>On Tue, 7 Feb 2006 [email-masked] wrote: 
> > >>>>    
> > >>>>
> > >>>>>My reading of the draft indicates there are 2 modes of 
> operation.
> > >>>>>
> > >>>>>a) Combined MAC (where the AP does everything)
> > >>>>>b) Split MAC (where the AC does most of the work)
> > >>>>>
> > >>>>>in case b) it is clear that the AC must act as the 
> radius relay.
> > >>>>>
> > >>>>>in case a) where the AC is just configuring the WTP, it is
> > >>>>>      
> > >>>>>
> > >>>>not clear
> > >>>>    
> > >>>>
> > >>>>>WHY the AC has to 'proxy' as the radius server.  I think the 
> > >>>>>restriction on REQUIRING that the AC act as the radius
> > >>>>>      
> > >>>>>
> > >>>>server (in base
> > >>>>    
> > >>>>
> > >>>>>a) is too strong.
> > >>>>>
> > >>>>>Philip
> > >>>>>
> > >>>>>Quoting Charles Clancy <[email-masked]>:
> > >>>>>
> > >>>>>      
> > >>>>>
> > >>>>>>Are you suggesting the WTPs communicate directly with the AAA 
> > >>>>>>server, and the AC configures the WTPs with the appropriate 
> > >>>>>>connection information?  Two thoughts:
> > >>>>>>
> > >>>>>>1. AAA traffic is trivial compared to everything else the
> > >>>>>>        
> > >>>>>>
> > >>>>AC will be
> > >>>>    
> > >>>>
> > >>>>>>doing, so the performance increase would be minimal.
> > >>>>>>
> > >>>>>>2. You've broken the keying/trust hierarchy.  Now
> > compromise of a
> > >>>>>>single WTP would allow an attacker the ability to
> > compromise all
> > >>>>>>networks that AAA server manages.  You can't contain
> > >>>>>>        
> > >>>>>>
> > >>>>attacks anymore.
> > >>>>    
> > >>>>
> > >>>>>>[ t. charles clancy ]--[ [email-masked] ]--[
> > >>>>>>        
> > >>>>>>
> > >>>>www.cs.umd.edu/~clancy ] [
> > >>>>    
> > >>>>
> > >>>>>>computer science ]-----[ university of maryland | 
> college park ]
> > >>>>>>
> > >>>>>>[email-masked] wrote:
> > >>>>>>        
> > >>>>>>
> > >>>>>>>I was wondering if it really makes sense in the NON
> > >>>>>>>          
> > >>>>>>>
> > >>>>split MAC case
> > >>>>    
> > >>>>
> > >>>>>>>to require the AC handle radius requests.  It seems
> > this is over
> > >>>>>>>burdening the AC.  The LWAPP protocol should allow the AC to 
> > >>>>>>>configure the radius server.
> > >>>>>>>
> > >>>>>>>regards,
> > >>>>>>>
> > >>>>>>>Philip
> > >>>>>>>
> > >>>>>>>_______________________________________________________
> > __________
> > >>>>>>>To unsubscribe or modify your subscription options,
> > please visit:
> > >>>>>>>http://lists.frascone.com/mailman/listinfo/capwap
> > >>>>>>>
> > >>>>>>>Archives: http://lists.frascone.com/pipermail/capwap
> > >>>>>>>          
> > >>>>>>>
> > >>>>>>________________________________________________________
> > _________
> > >>>>>>To unsubscribe or modify your subscription options,
> > please visit:
> > >>>>>>http://lists.frascone.com/mailman/listinfo/capwap
> > >>>>>>
> > >>>>>>Archives: http://lists.frascone.com/pipermail/capwap
> > >>>>>>
> > >>>>>>        
> > >>>>>>
> > 
> >>>>>_________________________________________________________________
> > >>>>>To unsubscribe or modify your subscription options, 
> please visit:
> > >>>>>http://lists.frascone.com/mailman/listinfo/capwap
> > >>>>>
> > >>>>>Archives: http://lists.frascone.com/pipermail/capwap
> > >>>>>
> > >>>>>      
> > >>>>>
> > 
> >>>>_________________________________________________________________
> > >>>>To unsubscribe or modify your subscription options, 
> please visit:
> > >>>>http://lists.frascone.com/mailman/listinfo/capwap
> > >>>>
> > >>>>Archives: http://lists.frascone.com/pipermail/capwap
> > >>>>
> > >>>>    
> > >>>>
> > >>>_________________________________________________________________
> > >>>To unsubscribe or modify your subscription options, please visit:
> > >>>http://lists.frascone.com/mailman/listinfo/capwap
> > >>>
> > >>>Archives: http://lists.frascone.com/pipermail/capwap
> > >>>
> > >>>
> > >>>  
> > >>>
> > > 
> > > 
> > 
> ----------------------------------------------------------------------
> > > --
> > > 
> > > _________________________________________________________________
> > > To unsubscribe or modify your subscription options, please visit:
> > > http://lists.frascone.com/mailman/listinfo/capwap
> > > 
> > > Archives: http://lists.frascone.com/pipermail/capwap
> > 
> _________________________________________________________________
> To unsubscribe or modify your subscription options, please visit:
> http://lists.frascone.com/mailman/listinfo/capwap
> 
> Archives: http://lists.frascone.com/pipermail/capwap
> 
_________________________________________________________________
To unsubscribe or modify your subscription options, please visit:
http://lists.frascone.com/mailman/listinfo/capwap

Archives: http://lists.frascone.com/pipermail/capwap