Subject: [Pana] CAPWAP and pre-authentication

From: "Alper Yegin" <[email-masked]>
Date: Tue, 21 Mar 2006 17:42:21 +0200

Pat,

During the PANA WG meeting you mentioned that CAPWAP can be used for
pre-authentication. Thinking it over, I presume you were referring to a
scenario where the host's EAP signaling is tunneled between the serving
authenticator and the target authenticator using CAPWAP. Is that right?
(Please also provide a reference for our reading.)

If so, note that this is a different model than what was presented. PANA
pre-authentication involves a direct signaling between the host and the
target authenticator that does not involve currently serving network (just
use it as a bearer).

Alper

_______________________________________________
Pana mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/pana

---

From: Rafa Marin Lopez <[email-masked]>
Date: Thu, 23 Mar 2006 17:46:57 -0500

Hi Alper,

Maybe I can answer to this.

After EMU WG, Yoshi and I had a meeting with Dorothy Stanley (thanks for 
your time), to discuss about this issue and to try to clarify this aspect.

 From the conversation , our understanding was next: (please Dorothy, do 
not hesitate to correct me if there is something wrong or not properly 
explained)

--- CAPWAP has not considered pre-authentication so far. In case of 
802.11i pre-authentication , an interface between current AC - target AC 
might be needed if both AC are not connected to the same DS and EAP 
authenticators are co-located in the ACs. CAPWAP considers interface 
between AC-AC as vendor specific (non-standard).

Having said that, my conclusion is that to support 802.11i 
pre-authentication between different DS would mean that interface is 
needed but it will not be standard. However PANA and IEEE 802.11i draft 
proposes a solution for this based on PANA.

--- Another possibility CAPWAP does not seem to consider is : two AC 
could not belong to the same administrative domain and no relation 
between them at all could be established. It would make unable to 
communicate both ACs to transport ieee 802.11i frames between both ACs. 
PANA - IEEE 802.11i draft proposed solution to overcome this problem.

Thus, i think there is still room to use PANA to overcome these problems.

Regards.

Alper Yegin wrote:

> pre-authentication. Thinking it over, I presume you were referring to 
> a scenario where the host’s EAP signaling is tunneled between the 
> serving authenticator and the target authenticator using CAPWAP. Is 
> that right? (Please also provide a reference for our reading.)
>
> If so, note that this is a different model than what was presented. 
> PANA pre-authentication involves a direct signaling between the host 
> and the target authenticator that does not involve currently serving 
> network (just use it as a bearer).
>
> Alper
>
>------------------------------------------------------------------------
>

-- 
------------------------------------------------------
Rafael Marin Lopez
Faculty of Computer Science-University of Murcia
30071 Murcia - Spain
Telf: +34968367645    e-mail: [email-masked]
------------------------------------------------------