1 / 13

Fast roaming in WPA

Explore the process of access point switching during client roaming in WPA networks. Find out how fast roaming and authentication mechanisms impact wireless connectivity. Detailed testing results and vendor reactions provided.

tomekam
Download Presentation

Fast roaming in WPA

An Image/Link below is provided (as is) to download presentation Download Policy: Content on the Website is provided to you AS IS for your information and personal use and may not be sold / licensed / shared on other websites without getting consent from its author. Content is provided to you AS IS for your information and personal use only. Download presentation by click this link. While downloading, if for some reason you are not able to download a presentation, the publisher may have deleted the file from their server. During download, if you can't get a presentation, the file might be deleted by the publisher.

E N D

Presentation Transcript

  1. Fast roaming in WPA T. Wolniewicz PIONIER

  2. Events causing access-point switching • Moving wireless client • Metwork card switching in search of better conditions • Client roaming initiated by the access-point • requires non-standard solutions like Cisco Client Extensions

  3. What happens during access-point change • STA needs to authenticate (delay!!) • Pairwise master key (PMK) must be distributed to STA and to the AP • PMK is sent by home Radius to STA as a part of the EAP conversation • PMK is sent to the AP within MS-MPPE-Recv-Key • WPA 4-way handshake must be completed between AP and the STA • Both sides verify that the peer knows PMK

  4. Roaming delay • Authentication can take several seconds, especially for eduroam guest access • WPA hanshake is fast (miliseconds)

  5. 802.11i/WPA2 • Preauthentication • NAS can authenticate to other APs not breaking association with its current AP • PMK caching • Both AP and NAS can keep a cache of PMKs to be reused when reassociation happens • WPA2 is supported in Windows, but preauthentication and PMK caching seem to require registry changes

  6. Controller based wireless systems • APs cannot function on their own • Controller acts as the Radius client • Controller knows all PMKs and in principle can perform WPA handshake between a new AP and STA using PMK established during a previous authentication between this STA and another controlled AP (if the STA will accept reusing the PMK for another AP) • All controller vendors claim this can be done and the AP change can be done within tens of milliseconds • This is what we have been testing

  7. How the test was performed • Laptop running Windows XP SP2, SP3 and Vista (SP1) (various wireless cards) • NTP synchronised time just before starting the test • fping – ping implementation allowing us to control ping frequency and response timeout • we have been sending packets every 100 ms with 200 ms timeout • we have been marking all ping responses with timestamps and writing them to a file • some software showing the associated AP • under vista “netsh wlan show interfaces” worked but only for some wireless cards • card-specific software was also used • Ping logs have been compared with the RADIUS authentication logs • Tests have been performed with both local and Surfnet showcase guest account • Network security was set to WPA/TKIP and in some cases WPA2/AES was also tested

  8. Additional voice test (only with Cisco) • Nokia E65 was used for voice test • fring was used to establish a Skype connection to a PC • PC’s mike was listening to the radio • I have listened to the voice on Nokia manually recording breaks in transmission

  9. Which systems have been tested • 3COM WX1200 with AP 8760 • Alcatel OmniAccess 4302 with AP 60 and 70 • vendor is coming back to us after some in-house testing • similar tests, with identical results, have been performed by PSNC on an Aruba system • Siemens HiPath Wireless C2400 Controller • Cisco 2000 Series WLAN Controller: 6 Aps • Trapeze Networks MXR-2 with MP-272 • test not complete, but this system will most likely behave the same as 3COM WX

  10. Test results • We have not observed a single case of AP roaming which would not require a reauthentication • Cisco roaming did require reauthentication but it was extremely fast with a local account (it was observable during voice transmission, but hardly), however during the guest access the break lasted between 1.5 and 3 seconds. • WPA2 test for Siemens showed that authentication happened visibly earlier then the AP switch, but still the break in transmission was over 1 second

  11. Vendor reaction • So far no vendor has been able to prove that we have been wrong in our tests • In some cases vendors have confirmed that they have not been able to produce authentication-less roaming in their labs • Some vendors started asking “why do you need this fast roaming anyway?” • Some vendors took their equipment back for further testing and we are still waiting for their response

  12. MERU Networks Virtual Cell • This is such a unique idea, that it requires separate description • In MERU solution all APs use the same channel and the same BSSID. • There are no collisions as the controller manages the time when the APs send their frames • From the STA point of view there is no roaming - STA sees only one AP • The de-facto roaming does not even require WPA handshake and does indeed happen absolutely smoothly

  13. MERU tests • We have been running tests with one controller and 15 APs running a production network at Faculty of Mathematics and Informatics. • There were some issues due to faulty hardware • In general the test passed OK

More Related