Network Working Group R. Zhang Internet-Draft China Telecom Intended status: Standards Track Z. Cao Expires: May 14, 2015 H. Deng China Mobile R. Pazhyannur S. Gundavelli Cisco L. Xue Huawei November 10, 2014 Alternate Tunnel Encapsulation for Data Frames in CAPWAP draft-ietf-opsawg-capwap-alt-tunnel-04 Abstract Control And Provisioning of Wireless Access Points (CAPWAP) defines a specification to encapsulate a station's data frames between the Wireless Transmission Point (WTP) and Access Controller (AC). Specifically, the station's IEEE 802.11 data frames can be either locally bridged or tunneled to the AC. When tunneled, a CAPWAP data channel is used for tunneling. In many deployments encapsulating data frames to an entity other than the AC (for example to an Access Router (AR)) is desirable. Further, it may also be desirable to use different tunnel encapsulations to carry the stations' data frames. This document provides a specification for this and refers to it as Alternate tunnel encapsulation. The Alternate tunnel encapsulation allows 1) the WTP to tunnel non-management data frames to an endpoint different from the AC and 2) the WTP to tunnel using one of many known encapsulation types such as IP-IP, IP-GRE, CAPWAP. The WTP may advertise support for Alternate tunnel encapsulation during the discovery or join process and AC may select one of the supported Alternate Tunnel encapsulation types while configuring the WTP. Status of This Memo This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79. Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet- Drafts is at http://datatracker.ietf.org/drafts/current/. Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any Zhang, et al. Expires May 14, 2015 [Page 1] Internet-Draft Alternate Tunnel November 2014 time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress." This Internet-Draft will expire on May 14, 2015. Copyright Notice Copyright (c) 2014 IETF Trust and the persons identified as the document authors. All rights reserved. This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License. Table of Contents 1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2 1.1. Conventions used in this document . . . . . . . . . . . . 5 1.2. Terminology . . . . . . . . . . . . . . . . . . . . . . . 5 2. Alternate Tunnel Encapsulation . . . . . . . . . . . . . . . 6 2.1. Description . . . . . . . . . . . . . . . . . . . . . . . 6 3. Protocol Considerations . . . . . . . . . . . . . . . . . . . 8 3.1. Supported Alternate Tunnel Encapsulations . . . . . . . . 8 3.2. Alternate Tunnel Encapsulations Type . . . . . . . . . . 9 3.3. IEEE 802.11 WTP Alternate Tunnel Failure Indication . . 10 4. IANA Considerations . . . . . . . . . . . . . . . . . . . . . 10 5. Security Considerations . . . . . . . . . . . . . . . . . . . 11 6. Contributors . . . . . . . . . . . . . . . . . . . . . . . . 12 7. References . . . . . . . . . . . . . . . . . . . . . . . . . 12 7.1. Normative References . . . . . . . . . . . . . . . . . . 12 7.2. Informative References . . . . . . . . . . . . . . . . . 12 Authors' Addresses . . . . . . . . . . . . . . . . . . . . . . . 12 1. Introduction Service Providers are deploying very large Wi-Fi deployments (ranging from hundreds of thousands of Access Points, APs (referred to as WTPs in CAPWAP terminology) to millions of APs. These networks are designed to carry traffic generated from mobile users. The volume in mobile user traffic is already very large (in the order of petabytes per day) and expected to continue growing rapidly. As a result, operators are looking for scalable solutions that can meet the Zhang, et al. Expires May 14, 2015 [Page 2] Internet-Draft Alternate Tunnel November 2014 increasing demand. The scalability requirement can be met by splitting the control/management plane from the data plane. This enables the data plane to scale independent of the control/management plane. This specification provides a way to enable such separation. CAPWAP ([RFC5415], [RFC5416]) defines a tunnel mode that describes how the WTP handles the data plane (user traffic). The following types are defined: o Local Bridging: All data frames are locally bridged. o 802.3 Tunnel: All data frames are tunneled to the AC in 802.3 format. o 802.11 Tunnel: All data frames are tunneled to the AC in 802.11 format. Figure 1 describes a system with Local Bridging. The AC is in a centralized location. The data plane is locally bridged by the WTPs leading to a system with centralized control plane with distributed data plane. This system has two benefits: 1) reduces the scale requirement on data traffic handling capability of the AC and 2) leads to more efficient/optimal routing of data traffic while maintaining centralized control/management. Locally Bridged +-----+ Data Frames +----------------+ | WTP |===============| Access Router | +-----+ +----------------+ \\ \\ CAPWAP Control Channel +----------+ ++=========================| AC | // CAPWAP Data Channel: | | // IEEE 802.11 Mgmt traffic +----------+ // +-----+ +----------------+ | WTP |============== | Access Router | +=====+ +----------------+ Locally Bridged Data Frames Figure 1: Centralized Control with Distributed Data The AC handles control of WTPs. In addition, the AC also handles the IEEE 802.11 management traffic to/ from the stations. There is CAPWAP Control and Data Channel between the WTP and the AC. Note that even though there is no user traffic transported between the WTP and AC, there is still a CAPWAP Data Channel. The CAPWAP Data Zhang, et al. Expires May 14, 2015 [Page 3] Internet-Draft Alternate Tunnel November 2014 channel carries the IEEE 802.11 management traffic (like IEEE 802.11 Action Frames). Figure 2 shows a system where the tunnel mode is configured to tunnel data frames between the WTP and the AC either using 802.3 Tunnel or 802.11 Tunnel configurations. Operators deploy this configuration when they need to tunnel the user traffic. The tunneling requirement may be driven by the need to apply policy at the Access Router or a legal requirement to support lawful intercept of user traffic. This requirement could be met in the locally bridged system (Figure 1) if the access router implemented the required policy. However, in many deployments the operator managing the WTP is different than the operator managing the Access Router. When the operators are different, the policy has to be enforced in a tunnel termination point in the WTP operator's network. +-----+ | WTP | +-----+ \\ \\ CAPWAP Control Channel +----------+ ++=========================| AC | // CAPWAP Data Channel: | | // IEEE 802.11 Mgmt traffic | | // Data Frames +----------+ // +-----+ | WTP | +=====+ Figure 2: Centralized Control and Centralized Data The key difference with the locally bridged system is that the data frames are tunneled to the AC instead of being locally bridged. There are two shortcomings with system in Figure 2. 1) They do not allow the WTP to tunnel data frames to an endpoint different from the AC and 2) They do not allow the WTP to tunnel data frames using any encapsulation other than CAPWAP (as specified in Section 4.4.2 of [RFC5415]). Figure 3 shows a system where the WTP tunnels data frames to an alternate entity different from the AC. The WTP also uses an alternate tunnel encapsulation such as such as L2TP, L2TPv3, IP-in- IP, IP/GRE, etc. This enables 1) independent scaling of data plane and 2) leveraging of commonly used tunnel encapsulations such as L2TP, GRE, etc Zhang, et al. Expires May 14, 2015 [Page 4] Internet-Draft Alternate Tunnel November 2014 Alternate Tunnel to AR (L2TPv3, IP-IP, CAPWAP, etc) _________ +-----+ ( ) +-----------------+ | WTP |======+Internet +==============|Access Router(AR)| +-----+ (_________} +-----------------+ \\ ________ CAPWAP Control \\ ( ) Channel +--------+ ++==Internet+========================| AC | // ( )CAPWAP Data Channel: +--------+ // IEEE 802.11 Mgmt traffic // --------- +-----+ ( ) +----------------+ | WTP |====+Internet +================| Access Router | +=====+ (_________} +----------------+ Alternate Tunnel to AR (L2TPv3, IP-IP, CAPWAP, etc) Figure 3: Centralized Control with Alternate Tunnel for Data The WTP may support widely used encapsulation types such as L2TP, L2TPv3, IP-in-IP, IP/GRE, etc. The WTP advertises the different alternate tunnel encapsulation types it can support. The AC configures one of the advertised types. As shown in the figure there is a CAPWAP control and data channel between the WTP and AC. The CAPWAP data channel carries the stations' management traffic as in the case of the locally bridged system. The main reason to maintain a CAPWAP data channel is to maintain similarity with the locally bridged system. The WTP maintains three tunnels: CAPWAP Control, CAPWAP Data, and another alternate tunnel for the data frame. The data frames are transported by an alternate tunnel between the WTP and a tunnel termination point such as an Access Router. This specification describes how the alternate tunnel can be established. The specification defines message elements for the WTP to advertise support for alternate tunnel encapsulation, the AC to configure alternate tunnel encapsulation, and for the WTP to report failure of the alternate tunnel. 1.1. Conventions used in this document The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 1.2. Terminology Station (STA): A device that contains an IEEE 802.11 conformant medium access control (MAC) and physical layer (PHY) interface to the wireless medium (WM). Zhang, et al. Expires May 14, 2015 [Page 5] Internet-Draft Alternate Tunnel November 2014 Access Controller (AC): The network entity that provides WTP access to the network infrastructure in the data plane, control plane, management plane, or a combination therein. Wireless Termination Point (WTP), The physical or network entity that contains an RF antenna and wireless Physical Layer (PHY) to transmit and receive station traffic for wireless access networks. CAPWAP Control Channel: A bi-directional flow defined by the AC IP Address, WTP IP Address, AC control port, WTP control port, and the transport-layer protocol (UDP or UDP-Lite) over which CAPWAP Control packets are sent and received. CAPWAP Data Channel: A bi-directional flow defined by the AC IP Address, WTP IP Address, AC data port, WTP data port, and the transport-layer protocol (UDP or UDP-Lite) over which CAPWAP Data packets are sent and received. In certain WTP modes, the CAPWAP Data Channel only transports IEEE 802.11 management frames and not the data plane (user traffic). 2. Alternate Tunnel Encapsulation 2.1. Description Zhang, et al. Expires May 14, 2015 [Page 6] Internet-Draft Alternate Tunnel November 2014 +-+-+-+-+-+-+ +-+-+-+-+-+-+ | WTP | | AC | +-+-+-+-+-+-+ +-+-+-+-+-+-+ |Join Request[Supported Alternate Tunnel | | Encapsulations ] | |---------------------------------------->| | | |Join Response | |<----------------------------------------| | | |IEEE 802.11 WLAN Config. Request [ | | IEEE 802.11 Add WLAN, | | Alternate Tunnel Encapsulation ( | | Tunnel Type, Tunnel Info Element) | | ] | |<----------------------------------------| | | | | +-+-+-+-+-+-+ | | Setup | | | Alternate | | | Tunnel | | +-+-+-+-+-+-+ | | | |IEEE 802.11 WLAN Config. Response | |---------------------------------------->| | | | | +-+-+-+-+-+-+ | | Tunnel | | | Failure | | +-+-+-+-+-+-+ | |WTP Alternate Tunnel Failure Indication | |(report failure) | |---------------------------------------->| | | +-+-+-+-+-+-+-+ | | Tunnel | | | Established | | +-+-+-+-+-+-+-+ | |WTP Alternate Tunnel Failure Indication | |(report clearing failure) | |---------------------------------------->| | | Figure 4: Setup of Alternate Tunnel Zhang, et al. Expires May 14, 2015 [Page 7] Internet-Draft Alternate Tunnel November 2014 The above example describes how the alternate tunnel encapsulation may be established. When the WTP joins the AC, it should indicate its alternate tunnel encapsulation capability. The AC determines whether an alternate tunnel configuration is required. If an appropriate alternate tunnel type is selected, then the AC provides the alternate tunnel encapsulation message element containing the tunnel type and a tunnel-specific information element. (The tunnel- specific information element, for example, may contain information like the IP address of the tunnel termination point.) The WTP sets up the alternate tunnel using the alternate tunnel encapsulation message element. On detecting a tunnel failure, WTP shall forward data frames to the AC and discard the frames. In addition, WTP may dissociate existing clients and refuse association requests from new clients. Depending on the implementation and deployment scenario, the AC may choose to reconfigure the WLAN (on the WTP) to a local bridging mode or to tunnel frames to the AC. When the WTP detects an alternate tunnel failure, the WTP informs the AC using a message element, WTP Alternate Tunnel Fail Indication (defined in this specification). The message element has a status field that indicates whether the message denotes reporting a failure or the clearing of the previously reported failure. For the case where AC is unreachable but the tunnel end point is still reachable, the WTP behavior is up to the implementation. For example, the WTP could either choose to tear down the alternate tunnel or let the existing user's traffic continue to be tunneled. 3. Protocol Considerations 3.1. Supported Alternate Tunnel Encapsulations This message element is sent by a WTP to communicate its capability to support alternate tunnel encapsulations. The message element contains the following fields: 0 1 2 3 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 +=+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Num_Tunnels | Tunnel-Type 1 | Tunnel-Type [2..N] +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 5: Supported Alternate Tunnel Encapsulations o Type: for Supported Alternate Tunnel Encapsulations o Length: The length in bytes is 1 + Num_Tunnels Zhang, et al. Expires May 14, 2015 [Page 8] Internet-Draft Alternate Tunnel November 2014 o Num_Tunnels: This refers to number of tunnel types present in the message element. At least one tunnel type must be present. o Tunnel-Type: This is identified by value defined in Section 3.2 3.2. Alternate Tunnel Encapsulations Type This message element is sent by the AC. This message element allows the AC to select the alternate tunnel encapsulation. This message element may be provided along with the IEEE 802.11 Add WLAN message element. When the message element is present the following fields of the IEEE 802.11 Add WLAN element shall be set as follows: MAC mode is set to 0 (Local MAC) and Tunnel Mode is set to 0 (Local Bridging). The message element contains the following fields 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Tunnel-Type | Info Element Length | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Info Element +-+-+-+-+-+-+-+-+-+ Figure 6: Alternate Tunnel Encapsulations Type o Type: for Alternate Tunnel Encapsulation Type o Length: > 4 o Tunnel-Type: The tunnel type is specified by a 2 byte value. This specification defines the values from zero (0) to five (5) as given below. The remaining values are reserved for future use. * 0: CAPWAP. This refers to a CAPWAP data channel described in [RFC5415][RFC5416]. * 1: L2TP. This refers to tunnel encapsulation described in [RFC2661]. * 2: L2TPv3. This refers to tunnel encapsulation described in [RFC3931]. * 3: IP-in-IP. This refers to tunnel encapsulation described in [RFC2003]. * 4: PMIPv6. This refers to the tunneling encapsulation described in [RFC5213] * 5: GRE-IPv4. This refers to GRE encapsulation with IPv4 as the delivery protocol as described in [RFC2784] * 6: GRE-IPv6. This refers to GRE encapsulation with IPv6 as the delivery protocol as described in [RFC2784] Zhang, et al. Expires May 14, 2015 [Page 9] Internet-Draft Alternate Tunnel November 2014 o Info Element: This field contains tunnel specific configuration parameters to enable the WTP to setup the alternate tunnel. For example if the tunnel type is CAPWAP then this field may contain the following (non-exhaustive) list of parameters * Access Router IPv4 address * Access Router IPv6 address * Tunnel DTLS Policy * IEEE 802.11 Tagging Policy This specification only defines a generic container for such message elements. We anticipate that these message elements (for the different protocols) will be defined in separate documents, potentially one for each tunneling protocols. 3.3. IEEE 802.11 WTP Alternate Tunnel Failure Indication The Alternate Tunnel Encapsulation message element is sent by the WTP to inform the AC about the status of the Alternate Tunnel. The message element contains the following fields 0 1 2 3 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ | Radio ID | WLAN ID | Status | Reserved | +-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+-+ Figure 7: IEEE 802.11 WTP Alternate Tunnel Failure Indication o Type: for IEEE 802.11 WTP Alternate Tunnel Failure Indication o Length: == 4 o Radio ID: The Radio Identifier, whose value is between one (1) and 31, typically refers to some interface index on the WTP. o WLAN ID: An 8-bit value specifying the WLAN Identifier. The value MUST be between one (1) and 16. o Status: An 8-bit boolean indicating whether the radio failure is being reported or cleared. A value of zero is used to clear the event, while a value of one is used to report the event. 4. IANA Considerations This document requires the following IANA considerations. Zhang, et al. Expires May 14, 2015 [Page 10] Internet-Draft Alternate Tunnel November 2014 o . This specification defines the Supported Alternate Tunnel Encapsulations Type message element in Section 3.1. This elements needs to be registered in the existing CAPWAP Message Element Type registry, defined in [RFC5415]. The Type value for this element needs to be between 1 and 1023 (see Section 15.7 in [RFC5415]). o . This specification defines the Alternate Tunnel Encapsulations Type message element in Section 3.2. This element needs to be registered in the existing CAPWAP Message Element Type registry, defined in [RFC5415]. The Type value for this element needs to be between 1 and 1023. o . This specification defines the IEEE 802.11 WTP Alternate Tunnel Failure Indication message element in Section 3.3. This element needs to be registered in the existing CAPWAP Message Element Type registry, defined in [RFC5415]. The Type value for this element needs to be between 1024 and 2047. o Tunnel-Type: This specification defines the Alternate Tunnel Encapsulations Type message element. This element contains a field Tunnel-Type. The namespace for the field is 16 bits (0-65535)). This specification defines values, zero (0) through six (6) and can be found in Section 3.2. Future allocations of values in this name space are to be assigned by IANA using the "Specification Required" policy. IANA needs to create a registry called CAPWAP Alternate Tunnel-Types. The registry format is given below. Tunnel-Type Type Value Reference CAPWAP 0 [RFC5415],[RFC5416] L2TP 1 [RFC2661] L2TPv3 2 [RFC3931] IP-IP 3 [RFC2003] PMIPv6 4 [RFC5213] GRE-IPv4 5 [RFC2784] GRE-IPv6 6 [RFC2784] 5. Security Considerations This document introduces three new CAPWAP WTP message elements. These elements are transported within CAPWAP Control messages as the existing message elements. Therefore, this document does not introduce any new security risks compared to [RFC5415] and [RFC5416]. In CAPWAP, security for CAPWAP Data Channel is optional and security policy is determined by AC. Similarly, the AC determines the security for the Alternate Tunnel between WTP and Alternate Tunnel Encapsulation Gateway. The security considerations described in [RFC5415] and [RFC5416] apply here as well. Zhang, et al. Expires May 14, 2015 [Page 11] Internet-Draft Alternate Tunnel November 2014 6. Contributors This document stems from the joint work of Hong Liu, Yifan Chen, Chunju Shao from China Mobile Research. 7. References 7.1. Normative References [RFC2003] Perkins, C., "IP Encapsulation within IP", RFC 2003, October 1996. [RFC2661] Townsley, W., Valencia, A., Rubens, A., Pall, G., Zorn, G., and B. Palter, "Layer Two Tunneling Protocol "L2TP"", RFC 2661, August 1999. [RFC2784] Farinacci, D., Li, T., Hanks, S., Meyer, D., and P. Traina, "Generic Routing Encapsulation (GRE)", RFC 2784, March 2000. [RFC3931] Lau, J., Townsley, M., and I. Goyret, "Layer Two Tunneling Protocol - Version 3 (L2TPv3)", RFC 3931, March 2005. [RFC5213] Gundavelli, S., Leung, K., Devarapalli, V., Chowdhury, K., and B. Patil, "Proxy Mobile IPv6", RFC 5213, August 2008. [RFC5415] Calhoun, P., Montemurro, M., and D. Stanley, "Control And Provisioning of Wireless Access Points (CAPWAP) Protocol Specification", RFC 5415, March 2009. [RFC5416] Calhoun, P., Montemurro, M., and D. Stanley, "Control and Provisioning of Wireless Access Points (CAPWAP) Protocol Binding for IEEE 802.11", RFC 5416, March 2009. 7.2. Informative References [RFC2119] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997. Authors' Addresses Rong Zhang China Telecom No.109 Zhongshandadao avenue Guangzhou 510630 China Email: zhangr@gsta.com Zhang, et al. Expires May 14, 2015 [Page 12] Internet-Draft Alternate Tunnel November 2014 Zhen Cao China Mobile Xuanwumenxi Ave. No. 32 Beijing 100871 China Phone: +86-10-52686688 Email: zehn.cao@gmail.com, caozhen@chinamobile.com Hui Deng China Mobile No.32 Xuanwumen West Street Beijing 100053 China Email: denghui@chinamobile.com Rajesh S. Pazhyannur Cisco 170 West Tasman Drive San Jose, CA 95134 USA Email: rpazhyan@cisco.com Sri Gundavelli Cisco 170 West Tasman Drive San Jose, CA 95134 USA Email: sgundave@cisco.com Li Xue Huawei No.156 Beiqing Rd. Z-park, HaiDian District Beijing China Email: xueli@huawei.com Zhang, et al. Expires May 14, 2015 [Page 13]