RFC 3990

RFC 3990: Configuration and Provisioning for Wireless Access Points (CAPWAP) Problem Statement ✨

Okay bestie, let's get into this one 🎀. It's an Informational RFC, which means it's giving "here's some context," not "you MUST do this." It was written in February 2005 by B. O'Hara (Airespace), P. Calhoun (Airespace), and J. Kempf (Docomo Labs USA) 💜. It doesn't obsolete or update any other RFCs, so it's a clean slate 🧚. The whole point is to lay out the problem that the CAPWAP working group wanted to fix, so the protocol folks would know what to build 💅.

---

Status of This Memo 🦋

Okay so this memo just provides info for the Internet community. It is not a standard of any kind 🌸. Distribution is totally unlimited, so share it with everyone 💖.

Copyright Notice 🌈

The Internet Society owns the copyright here, 2005 ✨.

1. Abstract 🫶

This doc describes the CAPWAP problem statement. That's the whole vibe 💜.

2. Introduction 🎀

Okay so the story starts in 1997, when the IEEE approved the 802.11 standard and wireless LANs started slowly sneaking into enterprise networks 🦋. The original 802.11 was only 1 and 2 Mbps, which was honestly not it 😭, so adoption was slow. It mostly showed up in vertical stuff like inventory, point of sale, and transportation management, and early enterprises were basically just experimenting 🧪.

Then in 1999 the IEEE approved 802.11a and 802.11b, which bumped things up to 54 and 11 Mbps and opened a new radio band 🔥. That removed one of the big blockers for large enterprise networks. The catch was that those big deployments were stuck with the definition of an 802.11 Access Point (AP) from the standard. The techniques needed lots of layer 2 bridging and tons of VLANs just to keep higher layer protocols working right 💀. People have described WLANs with several thousand APs, which is wild 😳.

Here's the thing though: big 802.11 WLANs have problems that need solving 🙈. Bridging doesn't scale, and honestly that shouldn't surprise anyone, because the same thing happened to wired bridging in the early 1980s when wired LANs were expanding and connecting 🍓. This doc is going to walk through the problems that show up when WLANs get huge in enterprise networks 💅.

3. Problem Statement 👑

Okay so big WLANs run into four main problems, periodt 💅.

Problem one: management overload. Every AP is an IP-addressable device that needs management, monitoring, and control 🖥️. A big WLAN basically doubles the number of network infrastructure devices you have to manage 😭. That's a huge burden on network admins, and it's often a reason people hesitate to adopt wireless. The kicker is that every AP's config is almost identical to the next one, and that near-sameness is exactly what leads to misconfiguration and weird broken behavior 🙈.

Problem two: keeping configs consistent. An AP's config has two parts: long-term static stuff (like addressing and hardware settings) and more dynamic provisioning stuff (like individual WLAN settings and security parameters) 🌸. Updating that dynamic info across every AP in a big WLAN takes forever 🐢. While the rollout is happening, the WLAN doesn't have one consistent config, because some APs are updated and some aren't 💀.

Problem three: the wireless medium is moody. The radio medium is shared with APs in the same WLAN, APs in other WLANs, and plain old non-AP devices too 📡. Parameters that control the medium on each AP have to be watched constantly and changed in a coordinated way to keep performance high ✨. All the APs need to coordinate so one doesn't interfere with its neighbors 🫶. Doing that by hand, figuring out the best new settings every time, takes a ton of time and effort 😩.

Problem four: security is a whole thing. Physical spots for APs are often hard to lock down, since they often have to sit outside a locked network closet or server room 🔐. If someone steals an AP, its embedded secrets could give them access to whatever those secrets protect 😱.

Vendors have started offering proprietary solutions that mix network switching, centralized control and management, and distributed wireless access into different new architectures 🦋. But interoperable solutions give enterprises and service providers more choice, so a standardized, interoperable interface between APs and a central controller sounds really desirable 💖.

Right now the physical parts of these systems are one or more 802.11 APs and one or more central control devices, which are also called controllers (or access controllers, ACs) 🎀. Ideally, a network designer could pick APs and central control devices from different vendors and still build a network that meets their needs 🧚.

Here's the sad part: current implementations are proprietary and don't interoperate 😭. That's because different manufacturers made really different architectural choices 🌈. The plan is to make a taxonomy of the architectures in today's products. That taxonomy becomes input for the IEEE 802.11 Working Group as they define the functional architecture of an AP 📚. CAPWAP will then review that functional architecture, including its functional blocks, interfaces, and information flow, to see whether more work is needed to apply or develop standard protocols for multi-vendor, interoperable WLANs built on this new hierarchical split between an AP and an access controller 👑.

4. Security Considerations 🔐

Okay this section is SO important, bestie 😭. WLAN devices control network access and deliver packets between hosts on the WLAN and hosts elsewhere on the Internet 🌐. So the functions for controlling and provisioning APs REQUIRE protection to stop misuse of the devices 🛡️.

Confidentiality, integrity, and authenticity requirements should be addressed for central management, monitoring, and control of APs 💜. Once an AP and AC have authenticated each other, one single level of authorization for monitoring, control, and provisioning may not be enough 🙈. Whether you need more than one level SHOULD be figured out 👀. Physical security matters too, especially for devices holding sensitive security parameters that could compromise the system if an attacker got them 🔒.

APs are often installed where they're hard to secure, since that's how you get full radio coverage 📡. The CAPWAP architecture may reduce the damage from a stolen AP 🦋. If high-value secrets, like a RADIUS shared secret, live in the AC, then losing an AP physically doesn't expose those secrets 🫶. And the AC can be put in a physically secure spot 🏰. Of course, putting all the high-value secrets in one place makes the AC a juicy target 🍯, so strict physical, procedural, and technical controls are needed to protect them 💀.

5. Authors' Addresses 💌

Bob O'Hara Airespace 110 Nortech Parkway San Jose, CA 95134 Phone: +1 408-635-2025 EMail: bob@airespace.com

Pat R. Calhoun Airespace 110 Nortech Parkway San Jose, CA 95134 Phone: +1 408-635-2000 EMail: pcalhoun@airespace.com

James Kempf Docomo Labs USA 181 Metro Drive, Suite 300 San Jose, CA 95110 Phone: +1 408 451 4711 EMail: kempf@docomolabs-usa.com

6. Full Copyright Statement 🌸

Copyright (C) The Internet Society (2005) 💖.

This document is subject to the rights, licenses and restrictions in BCP 78, and except as set forth there, the authors keep all their rights 🦋.

This document and the info in it are provided on an "AS IS" basis, and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE 💅.

7. Intellectual Property 🎀

The IETF takes no position on whether any Intellectual Property Rights might cover the tech in this doc, or whether licenses for it are available, and it doesn't claim to have checked for any such rights 🧐. Info on IETF procedures for rights in IETF Documents is in BCP 78 and BCP 79 📚.

Copies of IPR disclosures sent to the IETF Secretariat, plus any assurances of licenses, or the results of attempts to get a general license for implementers or users, can be found in the IETF online IPR repository at http://www.ietf.org/ipr 🌐.

The IETF invites anyone to bring copyrights, patents, patent applications, or other proprietary rights that might cover tech needed to implement this standard to its attention. Send that info to ietf-ipr@ietf.org 💌.

8. Acknowledgement 🙏

Funding for the RFC Editor function is currently provided by the Internet Society 💖✨.