Network Working Group R. Zhang Internet-Draft China Telecom Intended status: Standards Track Z. Cao Expires: August 18, 2014 H. Deng China Mobile R. Pazhyannur S. Gundavelli Cisco L. Xue Huawei February 14, 2014 Alternate Tunnel Encapsulation for Data Frames in CAPWAP draft-zhang-opsawg-capwap-cds-02 Abstract CAPWAP defines a specification to encapsulate a station's data frames between the Wireless Transmission Point (WTP) and Access Controller (AC) using CAPWAP. Specifically, the station's IEEE 802.11 data frames can be either locally bridged or tunneled to the AC. When tunneled, a CAPWAP data channel is used for tunneling. In many deployments it is desirable to encapsulate date frames to an entity different from the AC for example to an Access Router (AR). Further, it may also be desirable to use different tunnel encapsulations to carry the stations' data frames. This document provides a specification for this and refers to it as Alternate tunnel encapsulation. The Alternate tunnel encapsulation allows 1) the WTP to tunnel non-management data frames to an endpoint different from the AC and 2) the WTP to tunnel using one of many known encapsulation types such as IP-IP, IP-GRE, CAPWAP. The WTP may advertise support for Alternate tunnel encapsulation during the discovery or join process and AC may select one of the supported Alternate Tunnel encapsulation types while configuring the WTP. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at http://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any Zhang, et al. Expires August 18, 2014 [Page 1] Internet-Draft Alternate Tunnel February 2014 time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on August 18, 2014. Copyright Notice Copyright (c) 2014 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 1.1. Conventions used in this document . . . . . . . . . . . . 5 1.2. Terminology . . . . . . . . . . . . . . . . . . . . . . . 5 2. Alternate Tunnel Encapsulation . . . . . . . . . . . . . . . 5 2.1. Description . . . . . . . . . . . . . . . . . . . . . . . 5 2.2. Supported Alternate Tunnel Encapsulations . . . . . . . . 7 2.3. Alternate Tunnel Encapsulations Type . . . . . . . . . . 7 3. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 8 4. Security Considerations . . . . . . . . . . . . . . . . . . . 8 5. Contributors . . . . . . . . . . . . . . . . . . . . . . . . 9 6. References . . . . . . . . . . . . . . . . . . . . . . . . . 9 6.1. Normative References . . . . . . . . . . . . . . . . . . 9 6.2. Informative References . . . . . . . . . . . . . . . . . 9 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 9 1. Introduction CAPWAP ([RFC5415], [RFC5416]) defines a tunnel mode that specifies the frame tunneling type to be used for 802.11 data frames from stations associated with the WLAN. The following types are supported: o Local Bridging: All user traffic is to be locally bridged. o 802.3 Tunnel: All user traffic is to be tunneled to the AC in 802.3 format. Zhang, et al. Expires August 18, 2014 [Page 2] Internet-Draft Alternate Tunnel February 2014 o 802.11 Tunnel: All user traffic is to be tunneled to the AC in 802.11 format. There are two shortcomings with currently specified tunneled modes: 1) it does not allow the WTP to tunnel data frames to an endpoint different from the AC and 2) it does not allow the WTP to tunnel data frames using any encapsulation other than CAPWAP (as specified in Section 4.4.2 of [RFC5415]). Next, we describe what is driving the above mentioned two requirements. Some operators deploying large number of Access Points prefer to centralize the management and control of Access Points while distributing the handling of data traffic to increase scaling. This motivates an architecture as shown in Figure 1 that has the AC in a centralized location and one or more tunnel gateways (or Access Routers) that terminate the data tunnels from the various WTPs. This split architecture has two benefits over an architecture where data traffic is aggregated at the AC: 1) reduces the scale requirement on data traffic handling capability of the AC and 2) leads to more efficient/optimal routing of data traffic. Locally Bridged +-----+ DATA +----------------+ | WTP |==========| Access Router | +-----+ +----------------+ \\ \\ CAPWAP +--------+ ++======================+ AC | // +--------+ // +-----+// DATA +----------------+ | WTP |===========| Access Router | +=====+ +----------------+ Locally Bridged Figure 1: Centralized Control with Distributed Data The above system (shown in Figure 1) could be achieved by setting the tunnel mode to Local bridging. In such a case the AC would handle control of WTPs as well as handle the management traffic to/from the stations. There is CAPWAP Control and Data Channel between the WTP and the AC. The CAPWAP Data channel carries the IEEE 802.11 management traffic (like IEEE 802.11 Action Frames). The station's data frames are locally bridged, i.e., not carried over the CAPWAP data channel. The station's data frames are handled by the Access Router. However, in many deployments the operator managing the WTPs/ AC may be different from the operator providing the internet Zhang, et al. Expires August 18, 2014 [Page 3] Internet-Draft Alternate Tunnel February 2014 connectivity to the WTPs. Further, the WTP operator may want (or be required by legal/regulatory requirements) to tunnel the traffic back to an Access Router in its network as shown in Figure 2. The tunneling requirement may be driven by the need to apply policy at the Access Router or a legal requirement to support lawful intercept of user traffic. What this means is that local bridging does not meet their requirements. Their requriements are met either by having the WTP tunnel the station's traffic to the AC or the WTP support an alternate tunnel, i.e., a tunnel to an alternate entity different from the AC. This is the motivation for Alternate Tunnel encapsulation support where the data tunnels from the WTP are terminated at an AR (and more specifically at an end point different from the AC). Tunnel to AR _________ +-----+ ( ) +-----------------+ | WTP |======+Internet +==============|Access Router(AR)| +-----+ (_________} +-----------------+ \\ ________ \\ ( ) CAPWAP +--------+ ++==Internet+===============| AC | // ( ) +--------+ // ________ +-----+// ( ) +----------------+ | WTP |====+Internet +================| Access Router | +=====+ (_________} +----------------+ Tunnel to AR Figure 2: Centralized Control with Distributed Data In the case where the WTP is tunneling data frames to an AR (and not the AC), the choice of tunnel encapsulation need not be restricted only to CAPWAP (as described in Section 4.4.2 of [RFC5415]). In fact, the WTP may additionally support other widely used encapsulation types such as L2TP, L2TPv3, IP-in-IP, IP/GRE, etc. The WTP may advertise the different alternate tunnel encapsulation types supported and the AC can select one of the supported encapsulation types. As shown in the figure there is still a CAPWAP control and data channel between the WTP and AC wherein the CAPWAP data channel carries the stations' management traffic. Thus the WTP will maintain three tunnels: CAPWAP Control, CAPWAP Data, and another (alternate) tunnel to the AR. The main reason to maintain a CAPWAP data channel is to minimize the changes on the WTP and AC required to transport stations' management frames (like EAP, IEEE 802.11 Action Frames). These management frames are transported over the CAPWAP data channel as they are done for case when the WTP's tunnel mode is configured as Zhang, et al. Expires August 18, 2014 [Page 4] Internet-Draft Alternate Tunnel February 2014 the local bridging. In this specification we describe how the WTP can be configured with this alternate tunnel. 1.1. Conventions used in this document The key words "MUST", "MUST NOT", "REQUIRED", "SHALL","SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 1.2. Terminology Station (STA): A device that contains an IEEE 802.11 conformant medium access control (MAC) and physical layer (PHY) interface to the wireless medium (WM). Access Controller (AC): The network entity that provides WTP access to the network infrastructure in the data plane, control plane, management plane, or a combination therein. Wireless Termination Point (WTP), The physical or network entity that contains an RF antenna and wireless Physical Layer (PHY) to transmit and receive station traffic for wireless access networks. CAPWAP Control Channel: A bi-directional flow defined by the AC IP Address, WTP IP Address, AC control port, WTP control port, and the transport-layer protocol (UDP or UDP-Lite) over which CAPWAP Control packets are sent and received. CAPWAP Data Channel: A bi-directional flow defined by the AC IP Address, WTP IP Address, AC data port, WTP data port, and the transport-layer protocol (UDP or UDP-Lite) over which CAPWAP Data packets are sent and received. 2. Alternate Tunnel Encapsulation 2.1. Description Zhang, et al. Expires August 18, 2014 [Page 5] Internet-Draft Alternate Tunnel February 2014 +-+-+-+-+-+-+ +-+-+-+-+-+-+ | WTP | | AC | +-+-+-+-+-+-+ +-+-+-+-+-+-+ |Join Request[Supported Alternate Tunnel | | Encapsulations ] | |---------------------------------------->| | | |Join Response | |<----------------------------------------| | | |IEEE 802.11 WLAN Config. Request [ | | IEEE 802.11 Add WLAN, | | Alternate Tunnel Encapsulation ( | | Tunnel Type, Tunnel Specific Info) | | ] | |<----------------------------------------| | | |IEEE 802.11 WLAN Config. Response | |---------------------------------------->| | | | | +-+-+-+-+-+-+ | | Setup | | | Alternate | | | Tunnel | | +-+-+-+-+-+-+ | | | |WTP Event Request[Alt Tunnel Established]| |---------------------------------------->| | | | | +-+-+-+-+-+-+ | | Tunnel | | | Failure | | | | | +-+-+-+-+-+-+ | | | |Change State Event[Tunnel Failure] | |---------------------------------------->| Figure 3: Setup of Alternate Tunnel The above example describes how the alternate tunnel encapsulation may be established. When the WTP joins the AC, it should indicate its alternate tunnel encapsulation capability. The AC would determine whether an alternate tunnel configuration is required. If required, it would select an appropriate alternate tunnel encapsulation. The AC provides the alternate tunnel encapsulation Zhang, et al. Expires August 18, 2014 [Page 6] Internet-Draft Alternate Tunnel February 2014 message element that provides both the tunnel-type and tunnel specific information. The tunnel specific information may contain configuration information to help the WTP setup the tunnel. For example, the IP address of the access router that will terminate the WTP tunnel. Once the WTP sets up the tunnel, the WTP may inform the AC about the tunnel setup. Correspondingly, if the WTP discovers that the tunneled link to the AR has failed, then it may inform the AC. 2.2. Supported Alternate Tunnel Encapsulations This message element enables a WTP to communicate its capability to support alternate tunnel encapsulations to the AC. The WTP may commmunicate its capability during the discovery or join process. 0 1 2 3 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 +=+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- | Num_Tunnels | Tunnel_1 | Tunnel_[2..N].. +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- Figure 4: Supported Alternate Tunnel Encapsulations o Type: TBD for Supported Tunnel Encapsulations o Num_Tunnels >=1: This refers to number of profiles presnt in this messaage element. There must be at least one profile. o Tunnel: Each Tunnel is identified by value defined in the Tunnel Type field in Section 2.3 2.3. Alternate Tunnel Encapsulations Type The IEEE 802.11 Alternate Tunnel Encapsulation message element allows the AC to select the alternate tunnel encapsulation. This messsage element may be provided along with the IEEE 802.11 Add WLAN message element. When the message element is present the following fields of the IEEE 802.11 Add WLAN element shall be set as follows: MAC mode is set to 0 (Local MAC) and Tunnel Mode is set to 0 (Local Bridging). 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- | Tunnel Type | Tunnel Specific | | Information +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- Figure 5: Alternate Tunnel Encapsulations Type o Type: TBD for Alternate Tunnel Encapsulation Type Zhang, et al. Expires August 18, 2014 [Page 7] Internet-Draft Alternate Tunnel February 2014 o Tunnel Type: The profile is identified by a value given below * 0: CAPWAP data channel as described in [RFC5415][RFC5416] * 1: L2TP * 2: L2TPv3 * 3: IP-in-IP * 4: IP/GRE o Tunnel Specific Information: This field contains tunnel specific information that is used to configure the WTP with parameters needed for alternate tunnel setup. 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- | Length | Data +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+- Figure 6: Tunnel Specific Information * Length: * Data: The data field would contain tunnel specific information to assist the WTP in setting up the alternate tunnel. For example if the tunnel type is CAPWAP then the data field would contain the following (non-exhaustive) list of parameters + Access Router IPv4 address + Access Router IPv6 address + Tunnel DTLS Policy + IEEE 802.11 Tagging Policy This specification only defines a generic container for such message elements. We anticipate that these message elements (for the different protocols) will be defined in separate documents, potentially one for each tunneling protocols. See [I-D.xue-opsawg-capwap-separation-capability] for example of such a specification. 3. IANA Considerations To be specified in later versions 4. Security Considerations To be specified in later versions. Zhang, et al. Expires August 18, 2014 [Page 8] Internet-Draft Alternate Tunnel February 2014 5. Contributors This document stems from the joint work of Hong Liu, Yifan Chen, Chunju Shao from China Mobile Research. 6. References 6.1. Normative References [RFC5415] Calhoun, P., Montemurro, M., and D. Stanley, "Control And Provisioning of Wireless Access Points (CAPWAP) Protocol Specification", RFC 5415, March 2009. [RFC5416] Calhoun, P., Montemurro, M., and D. Stanley, "Control and Provisioning of Wireless Access Points (CAPWAP) Protocol Binding for IEEE 802.11", RFC 5416, March 2009. 6.2. Informative References [I-D.xue-opsawg-capwap-separation-capability] Xue, L., Du, Z., Liu, D., Zhang, R., and J. Kaippallimalil, "Capability Announcement and AR Discovery in CAPWAP Control and Data Channel Separation", draft-xue- opsawg-capwap-separation-capability-01 (work in progress), October 2013. [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997. Authors' Addresses Rong Zhang China Telecom No.109 Zhongshandadao avenue Guangzhou 510630 China Email: zhangr@gsta.com Zhen Cao China Mobile Xuanwumenxi Ave. No. 32 Beijing 100871 China Phone: +86-10-52686688 Email: zehn.cao@gmail.com, caozhen@chinamobile.com Zhang, et al. Expires August 18, 2014 [Page 9] Internet-Draft Alternate Tunnel February 2014 Hui Deng China Mobile No.32 Xuanwumen West Street Beijing 100053 China Email: denghui@chinamobile.com Rajesh S. Pazhyannur Cisco 170 West Tasman Drive San Jose, CA 95134 USA Email: rpazhyan@cisco.com Sri Gundavelli Cisco 170 West Tasman Drive San Jose, CA 95134 USA Email: sgundave@cisco.com Li Xue Huawei No.156 Beiqing Rd. Z-park, Shi-Chuang-Ke-Ji-Shi-Fan-Yuan, HaiDian District Beijing China Email: xueli@huawei.com Zhang, et al. Expires August 18, 2014 [Page 10]