rfc-7494

IEEE 802.11 Medium Access Control (MAC) Profile for Control and Provisioning of Wireless Access Points (CAPWAP)

C. Shao, H. Deng, R. Pazhyannur, F. Bari, R. Zhang, S. Matsushima

date2015-04 streamIETF areaops wgopsawg statusPROPOSED STANDARD pages13 canonicalhttps://www.rfc-editor.org/rfc/rfc7494 doi10.17487/RFC7494

The Control and Provisioning of Wireless Access Points (CAPWAP) protocol binding for IEEE 802.11 defines two Medium Access Control (MAC) modes for IEEE 802.11 Wireless Transmission Points (WTPs): Split and Local MAC. In the Split MAC mode, the partitioning of encryption/decryption functions is not clearly defined. In the Split MAC mode description, IEEE 802.11 encryption is specified as located in either the Access Controller (AC) or the WTP, with no clear way for the AC to inform the WTP of where the encryption functionality should be located. This leads to interoperability issues, especially when the AC and WTP come from different vendors. To prevent interoperability issues, this specification defines an IEEE 802.11 MAC Profile message element in which each profile specifies an unambiguous division of encryption functionality between the WTP and AC.

Extracted elements (14)

design-rationale §2.1

Fragmentation is always co-located with encryption in both profiles because fragmentation and encryption are functionally coupled in IEEE 802.11; placing them at different entities would require re-encryption of fragments, which is not supported.

security

design-rationale §1

The existing CAPWAP Split MAC mode left IEEE 802.11 encryption/decryption location ambiguous (WTP or AC), causing interoperability failures between multi-vendor deployments. This document introduces the MAC Profile to eliminate that ambiguity by explicitly assigning encryption and dependent functions to one entity.

security, interoperability-note

interoperability-note §1

Prior to this specification, different vendors mapped IEEE 802.11 encryption to different locations in Split MAC mode, requiring operators to apply vendor-specific configurations and causing interoperability failures when mixing AC and WTP equipment from different vendors.

security

normative-requirement §3.1 MUST

The IEEE 802.11 Supported MAC Profiles message element MUST contain at least one profile (Num_Profiles >= 1).

protocol-element §2.3

MAC Profile negotiation uses a two-message exchange: the WTP advertises supported profiles in a Discovery Request or Join Request message via the IEEE 802.11 Supported MAC Profiles element; the AC selects and configures the profile in the IEEE 802.11 WLAN Config Request alongside the Add WLAN element.

protocol-element §2.2

Split MAC with AC Encryption (Profile 1): encryption/decryption and fragmentation/defragmentation are performed at the AC; beacon generation, probe response, power management, and queuing remain at the WTP; RSNA key management and IEEE 802.1X/EAP are at the AC.

security

protocol-element §2.1

Split MAC with WTP Encryption (Profile 0): encryption/decryption and fragmentation/defragmentation are performed at the WTP; distribution service, integration service, association handling, and QoS classification are at the AC; RSNA key management and IEEE 802.1X/EAP remain at the AC.

security

protocol-element §3.2

The IEEE 802.11 MAC Profile element is carried by the AC in the WLAN Config Request alongside the IEEE 802.11 Add WLAN element, making encryption-location selection part of per-WLAN configuration rather than a global session parameter.

protocol-element §3.1

The IEEE 802.11 Supported MAC Profiles element may be carried in Discovery Request, Primary Discovery Request, or Join Request messages, allowing the WTP to advertise its capabilities early in the CAPWAP session establishment.

registry §5

A new 'IEEE 802.11 Split MAC Profile' subregistry is created under the 'Control And Provisioning of Wireless Access Points (CAPWAP) Parameters' registry. The 8-bit namespace defines Profile 0 (Split MAC with WTP encryption) and Profile 1 (Split MAC with AC encryption); values 2-255 require Expert Review per RFC 5226.

registry

registry §5

Two new entries added to the existing 'CAPWAP Message Element Type' registry (defined in RFC 5415): IEEE 802.11 Supported MAC Profiles (Type 1060) and IEEE 802.11 MAC Profile (Type 1061).

registry

security-consideration §4

This document introduces no new security risks relative to RFC 5416. The MAC Profile negotiation messages are protected by CAPWAP's existing origin authentication and data integrity mechanisms, preventing an attacker from downgrading the selected encryption mode.

security

wire-format §3.2

IEEE 802.11 MAC Profile message element (Type 1061): a single 8-bit Profile field; value 0 indicates Split MAC with WTP encryption, value 1 indicates Split MAC with AC encryption.

registry

wire-format §3.1

IEEE 802.11 Supported MAC Profiles message element (Type 1060): an 8-bit Num_Profiles field followed by one 8-bit Profile field per supported profile; Num_Profiles MUST be at least 1.

registry