Network Working Group L. Yang
Request for Comments: 4118 Intel Corp.
Category: Informational P. Zerfos
UCLA
E. Sadot
Avaya
June 2005
Network Working Group L. Yang
Request for Comments: 4118 Intel Corp.
Category: Informational P. Zerfos
UCLA
E. Sadot
Avaya
June 2005
Architecture Taxonomy for Control and Provisioning of Wireless Access Points (CAPWAP)
无线接入点控制和供应的体系结构分类法（CAPWAP）
Status of This Memo
关于下段备忘
This memo provides information for the Internet community. It does not specify an Internet standard of any kind. Distribution of this memo is unlimited.
本备忘录为互联网社区提供信息。它没有规定任何类型的互联网标准。本备忘录的分发不受限制。
Copyright Notice
版权公告
Copyright (C) The Internet Society (2005).
版权所有（C）互联网协会（2005年）。
Abstract
摘要
This document provides a taxonomy of the architectures employed in the existing IEEE 802.11 products in the market, by analyzing Wireless LAN (WLAN) functions and services and describing the different variants in distributing these functions and services among the architectural entities.
本文档通过分析无线局域网（WLAN）功能和服务，并描述在体系结构实体之间分配这些功能和服务的不同变体，提供了市场上现有IEEE 802.11产品所采用体系结构的分类。
Table of Contents
目录
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
1.1. IEEE 802.11 WLAN Functions . . . . . . . . . . . . . . 3
1.2. CAPWAP Functions . . . . . . . . . . . . . . . . . . . 5
1.3. WLAN Architecture Proliferation . . . . . . . . . . . 6
1.4. Taxonomy Methodology and Document Organization . . . . 8
2. Conventions . . . . . . . . . . . . . . . . . . . . . . . . 9
3. Definitions . . . . . . . . . . . . . . . . . . . . . . . . 9
3.1. IEEE 802.11 Definitions . . . . . . . . . . . . . . . 9
3.2. Terminology Used in This Document . . . . . . . . . . 11
3.3. Terminology Used Historically but Not Recommended . . 13
4. Autonomous Architecture . . . . . . . . . . . . . . . . . . 13
4.1. Overview . . . . . . . . . . . . . . . . . . . . . . 13
4.2. Security . . . . . . . . . . . . . . . . . . . . . . . 14
5. Centralized WLAN Architecture . . . . . . . . . . . . . . . 15
5.1. Interconnection between WTPs and ACs . . . . . . . . . 16
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 2
1.1. IEEE 802.11 WLAN Functions . . . . . . . . . . . . . . 3
1.2. CAPWAP Functions . . . . . . . . . . . . . . . . . . . 5
1.3. WLAN Architecture Proliferation . . . . . . . . . . . 6
1.4. Taxonomy Methodology and Document Organization . . . . 8
2. Conventions . . . . . . . . . . . . . . . . . . . . . . . . 9
3. Definitions . . . . . . . . . . . . . . . . . . . . . . . . 9
3.1. IEEE 802.11 Definitions . . . . . . . . . . . . . . . 9
3.2. Terminology Used in This Document . . . . . . . . . . 11
3.3. Terminology Used Historically but Not Recommended . . 13
4. Autonomous Architecture . . . . . . . . . . . . . . . . . . 13
4.1. Overview . . . . . . . . . . . . . . . . . . . . . . 13
4.2. Security . . . . . . . . . . . . . . . . . . . . . . . 14
5. Centralized WLAN Architecture . . . . . . . . . . . . . . . 15
5.1. Interconnection between WTPs and ACs . . . . . . . . . 16
5.2. Overview of Three Centralized WLAN Architecture
Variants . . . . . . . . . . . . . . . . . . . . . . . 17
5.3. Local MAC . . . . . . . . . . . . . . . . . . . . . . 19
5.4. Split MAC . . . . . . . . . . . . . . . . . . . . . . 22
5.5. Remote MAC . . . . . . . . . . . . . . . . . . . . . . 27
5.6. Comparisons of Local MAC, Split MAC, and Remote MAC. . 27
5.7. Communication Interface between WTPs and ACs . . . . . 29
5.8. Security . . . . . . . . . . . . . . . . . . . . . . . 29
5.8.1. Client Data Security . . . . . . . . . . . . . 30
5.8.2. Security of Control Channel between
the WTP and AC . . . . . . . . . . . . . . . . 30
5.8.3. Physical Security of WTPs and ACs . . . . . . 31
6. Distributed Mesh Architecture . . . . . . . . . . . . . . . 32
6.1. Common Characteristics . . . . . . . . . . . . . . . . 32
6.2. Security . . . . . . . . . . . . . . . . . . . . . . . 33
7. Summary and Conclusions . . . . . . . . . . . . . . . . . . 33
8. Security Considerations . . . . . . . . . . . . . . . . . . 36
9. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 37
10. Normative References . . . . . . . . . . . . . . . . . . . . 39
5.2. Overview of Three Centralized WLAN Architecture
Variants . . . . . . . . . . . . . . . . . . . . . . . 17
5.3. Local MAC . . . . . . . . . . . . . . . . . . . . . . 19
5.4. Split MAC . . . . . . . . . . . . . . . . . . . . . . 22
5.5. Remote MAC . . . . . . . . . . . . . . . . . . . . . . 27
5.6. Comparisons of Local MAC, Split MAC, and Remote MAC. . 27
5.7. Communication Interface between WTPs and ACs . . . . . 29
5.8. Security . . . . . . . . . . . . . . . . . . . . . . . 29
5.8.1. Client Data Security . . . . . . . . . . . . . 30
5.8.2. Security of Control Channel between
the WTP and AC . . . . . . . . . . . . . . . . 30
5.8.3. Physical Security of WTPs and ACs . . . . . . 31
6. Distributed Mesh Architecture . . . . . . . . . . . . . . . 32
6.1. Common Characteristics . . . . . . . . . . . . . . . . 32
6.2. Security . . . . . . . . . . . . . . . . . . . . . . . 33
7. Summary and Conclusions . . . . . . . . . . . . . . . . . . 33
8. Security Considerations . . . . . . . . . . . . . . . . . . 36
9. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 37
10. Normative References . . . . . . . . . . . . . . . . . . . . 39
As IEEE 802.11 Wireless LAN (WLAN) technology matures, large scale deployment of WLAN networks is highlighting certain technical challenges. As outlined in [2], management, monitoring, and control of large number of Access Points (APs) in the network may prove to be a significant burden for network administration. Distributing and maintaining a consistent configuration throughout the entire set of APs in the WLAN is a difficult task. The shared and dynamic nature of the wireless medium also demands effective coordination among the APs to minimize radio interference and maximize network performance. Network security issues, which have always been a concern in WLANs, present even more challenges in large deployments and new architectures.
随着IEEE 802.11无线局域网（WLAN）技术的成熟，WLAN网络的大规模部署凸显了某些技术挑战。如[2]所述，网络中大量接入点（AP）的管理、监控和控制可能会成为网络管理的一个重大负担。在WLAN中的整个AP集中分发和维护一致的配置是一项困难的任务。无线媒体的共享性和动态性还要求AP之间进行有效的协调，以最大限度地减少无线电干扰和提高网络性能。网络安全问题一直是无线局域网关注的一个问题，在大型部署和新体系结构中提出了更多的挑战。
Recently many vendors have begun offering partially proprietary solutions to address some or all of the above mentioned problems. Since interoperable systems allow for a broader choice of solutions, a standardized interoperable solution addressing the aforementioned problems is desirable. As the first step toward establishing interoperability in the market place, this document provides a taxonomy of the architectures employed in existing WLAN products. We hope to provide a cohesive understanding of the market practices for the standard bodies involved (including the IETF and IEEE 802.11). This document may be reviewed and utilized by the IEEE 802.11 Working Group as input in defining the functional architecture of an AP.
最近，许多供应商已经开始提供部分专有解决方案来解决上述部分或全部问题。由于可互操作系统允许更广泛的解决方案选择，因此需要解决上述问题的标准化可互操作解决方案。作为在市场上建立互操作性的第一步，本文档提供了现有WLAN产品中使用的体系结构分类。我们希望为相关标准机构（包括IETF和IEEE 802.11）提供对市场实践的统一理解。IEEE 802.11工作组可审查并使用本文件作为定义AP功能架构的输入。
The IEEE 802.11 specifications are wireless standards that specify an "over-the-air" interface between a wireless client Station (STA) and an Access Point (AP), and also among wireless clients. 802.11 also describes how mobile devices can associate into a basic service set (BSS). A BSS is identified by a basic service set identifier (BSSID) or name. The WLAN architecture can be considered as a type of 'cell' architecture, in which each cell is the Basic Service Set (BSS), and each BSS is controlled by the AP. When two or more APs are connected via a broadcast layer 2 network and all are using the same SSID, an extended service set (ESS) is created.
IEEE 802.11规范是无线标准，规定了无线客户端站（STA）和接入点（AP）之间以及无线客户端之间的“空中”接口。802.11还描述了移动设备如何关联到基本服务集（BSS）。BSS由基本服务集标识符（BSSID）或名称标识。WLAN架构可以被视为一种“小区”架构，其中每个小区都是基本服务集（BSS），每个BSS都由AP控制。当两个或多个AP通过广播层2网络连接，并且所有AP都使用相同的SSID时，将创建扩展服务集（ESS）。
The architectural component used to interconnect BSSs is the distribution system (DS). An AP is an STA that provides access to the DS by providing DS services, as well as acting as an STA. Another logical architectural component, portal, is introduced to integrate the IEEE 802.11 architecture with a traditional wired LAN. It is possible for one device to offer both the functions of an AP and a portal.
用于互连BSS的体系结构组件是配电系统（DS）。AP是通过提供DS服务以及充当STA来提供对DS的访问的STA。引入了另一个逻辑体系结构组件portal，以将ieee802.11体系结构与传统的有线局域网集成。一台设备可以同时提供AP和门户的功能。
IEEE 802.11 does not specify the details of DS implementations explicitly. Instead, the 802.11 standard defines services that provide functions that the LLC layer requires for sending MAC Service Data Units (MSDUs) between two entities on the network. These services can be classified into two categories: the station service (SS) and the distribution system service (DSS). Both categories of service are used by the IEEE 802.11 MAC sublayer. Station services consist of the following four services:
IEEE 802.11没有明确规定DS实现的细节。相反，802.11标准定义的服务提供LLC层在网络上两个实体之间发送MAC服务数据单元（MSDU）所需的功能。这些服务可分为两类：车站服务（SS）和配电系统服务（DSS）。IEEE 802.11 MAC子层使用这两类服务。车站服务包括以下四项服务：
o Authentication: Establishes the identity of one station as a member of the set of stations that are authorized to associate with one another.
o 身份验证：将一个站点的身份建立为被授权相互关联的一组站点的成员。
o De-authentication: Voids an existing authentication relationship.
o 取消身份验证：使现有身份验证关系无效。
o Confidentiality: Prevents the content of messages from being read by others than the intended recipients.
o 机密性：防止邮件内容被预期收件人以外的其他人阅读。
o MSDU Delivery: Delivers the MAC service data unit (MSDU) for the stations.
o MSDU交付：为站点交付MAC服务数据单元（MSDU）。
Distribution system services consist of the following five services:
配电系统服务包括以下五项服务：
o Association: Establishes Access Point/Station (AP/STA) mapping and enables STA invocation of the distribution system services.
o 关联：建立接入点/站点（AP/STA）映射，并启用分布式系统服务的STA调用。
o Disassociation: Removes an existing association.
o 解除关联：删除现有关联。
o Reassociation: Enables an established association (between AP and STA) to be transferred from one AP to another or the same AP.
o 重新关联：使已建立的关联（AP和STA之间）能够从一个AP转移到另一个AP或同一AP。
o Distribution: Provides MSDU forwarding by APs for the STAs associated with them. MSDUs can be either forwarded to the wireless destination or to the wired (Ethernet) destination (or both) using the "Distribution System" concept of 802.11.
o 分发：通过AP为与其关联的STA提供MSDU转发。MSDU可以使用802.11的“分发系统”概念转发到无线目的地或有线（以太网）目的地（或两者）。
o Integration: Translates the MSDU received from the Distribution System to a non-802.11 format and vice versa. Any MSDU that is received from the DS invokes the 'Integration' services of the DSS before the 'Distribution' services are invoked. The point of connection of the DS to the wired LAN is termed as 'portal'.
o 集成：将从分发系统接收的MSDU转换为非802.11格式，反之亦然。从DS接收的任何MSDU都会在调用“分发”服务之前调用DSS的“集成”服务。DS与有线LAN的连接点称为“入口”。
Apart from these services, the IEEE 802.11 also defines additional MAC services that must be implemented by the APs in the WLAN. For example:
除了这些服务外，IEEE 802.11还定义了必须由WLAN中的AP实现的附加MAC服务。例如：
o Beacon Generation
o 信标生成
o Probe Response/Transmission
o 探头响应/传输
o Processing of Control Frames: RTS/CTS/ACK/PS-Poll/CF-End/CF-ACK
o 控制帧处理：RTS/CTS/ACK/PS轮询/CF结束/CF-ACK
o Synchronization
o 同步
o Retransmissions
o 重发
o Transmission Rate Adaptation
o 传输速率自适应
o Privacy: 802.11 Encryption/Decryption
o 隐私：802.11加密/解密
In addition to the services offered by the 802.11, the IEEE 802.11 WG is also developing technologies to support Quality of Service (802.11e), Security Algorithms (802.11i), Inter-AP Protocol (IAPP, or 802.11F -- recommended practice) to update APs when a STA roams from one BSS to another, Radio Resource Measurement Enhancements (802.11k), etc.
除了802.11提供的服务外，IEEE 802.11工作组还正在开发支持服务质量（802.11e）、安全算法（802.11i）、AP间协议（IAPP或802.11F——推荐做法）的技术，以在STA从一个BSS漫游到另一个BSS时更新AP、无线资源测量增强（802.11k）等。
IEEE 802.11 does not specify exactly how these functions are implemented, nor does it specify that they be implemented in one physical device. It only requires that the APs and the rest of the DS together implement all these services. Typically, vendors implement not only the services defined in the IEEE 802.11 standard, but also a variety of value-added services or functions, such as load balancing support, QoS, station mobility support, and rogue AP
IEEE 802.11没有明确规定如何实现这些功能，也没有规定在一个物理设备中实现这些功能。它只要求AP和其余DS一起实现所有这些服务。通常，供应商不仅实现IEEE 802.11标准中定义的服务，还实现各种增值服务或功能，例如负载平衡支持、QoS、站点移动性支持和rogue AP
detection. What becomes clear from this document is that vendors take advantage of the flexibility in the 802.11 architecture, and have come up with many different flavors of architectures and implementations of the WLAN services.
侦查从本文档中可以清楚地看到，供应商利用了802.11体系结构中的灵活性，并提出了许多不同风格的WLAN服务体系结构和实现。
Because many vendors choose to implement these WLAN services across multiple network elements, we want to make a clear distinction between the logical WLAN access network functions and the individual physical devices by adopting different terminology. We use "AP" to refer to the logical entity that provides access to the distribution services, and "WTP" (Wireless Termination Point) to the physical device that allows the RF antenna and 802.11 PHY to transmit and receive station traffic in the BSS network. In the Centralized Architecture (see section 5), the combination of WTPs with Access Controller (AC) implements all the logical functions. Each of these physical devices (WTP or AC) may implement only part of the logical functions. But the DS, including all the physical devices as a whole, implements all or most of the functions.
由于许多供应商选择跨多个网络元素实现这些WLAN服务，因此我们希望通过采用不同的术语来明确区分逻辑WLAN接入网络功能和单个物理设备。我们使用“AP”来表示提供对分发服务的访问的逻辑实体，使用“WTP”（无线终端点）来表示允许RF天线和802.11 PHY在BSS网络中发送和接收站点流量的物理设备。在集中式体系结构中（参见第5节），WTP与访问控制器（AC）的组合实现了所有逻辑功能。这些物理设备（WTP或AC）中的每一个都只能实现部分逻辑功能。但是DS，包括作为一个整体的所有物理设备，实现了所有或大部分功能。
To address the four problems identified in [2] (management, consistent configuration, RF control, security) additional functions, especially in the control and management plane, are typically offered by vendors to assist in better coordination and control across the entire ESS network. Such functions are especially important when the IEEE 802.11 WLAN functions are implemented over multiple entities in a large scale network, instead of within a single entity. Such functions include:
为了解决[2]中确定的四个问题（管理、一致配置、射频控制、安全），供应商通常会提供额外的功能，特别是在控制和管理层面，以帮助整个ESS网络更好地协调和控制。当IEEE 802.11 WLAN功能在大规模网络中的多个实体上实现时，而不是在单个实体内实现时，此类功能尤其重要。这些职能包括：
o RF monitoring, such as Radar detection, noise and interference detection, and measurement.
o 射频监测，如雷达检测、噪声和干扰检测以及测量。
o RF configuration, e.g., for retransmission, channel selection, transmission power adjustment.
o 射频配置，例如，用于重传、信道选择、传输功率调整。
o WTP configuration, e.g., for SSID.
o WTP配置，例如SSID。
o WTP firmware loading, e.g., automatic loading and upgrading of WTP firmware for network wide consistency.
o WTP固件加载，例如，自动加载和升级WTP固件以实现网络范围的一致性。
o Network-wide STA state information database, including the information needed to support value-added services, such as mobility and load balancing.
o 网络范围的STA状态信息数据库，包括支持增值服务所需的信息，如移动性和负载平衡。
o Mutual authentication between network entities, e.g., for AC and WTP authentication in a Centralized WLAN Architecture.
o 网络实体之间的相互认证，例如，集中WLAN体系结构中的AC和WTP认证。
The services listed are concerned with the configuration and control of the radio resource ('RF Monitoring' and 'RF Configuration'), management and configuration of the WTP device ('WTP Configuration', 'WTP Firmware upgrade'), and also security regarding the registration of the WTP to an AC ('AC/WTP mutual authentication'). Moreover, the device from which other services, such as mobility management across subnets and load balancing, can obtain state information regarding the STA(s) associated with the wireless network, is also reported as a service ('STA state info database').
列出的服务涉及无线电资源的配置和控制（“RF监控”和“RF配置”）、WTP设备的管理和配置（“WTP配置”、“WTP固件升级”），以及有关向AC注册WTP的安全（“AC/WTP相互认证”）。此外，其他服务（例如跨子网的移动性管理和负载平衡）可以从中获得与无线网络相关联的STA的状态信息的设备也被报告为服务（“STA状态信息数据库”）。
The above list of CAPWAP functions is not an exhaustive enumeration of all additional services offered by vendors. We included only those functions that are commonly represented in the survey data, and are pertinent to understanding the central problem of interoperability.
上述CAPWAP功能列表并不是供应商提供的所有附加服务的详尽列表。我们只包括调查数据中常见的功能，这些功能与理解互操作性的核心问题相关。
Most of these functions are not explicitly specified by IEEE 802.11, but some of the functions are. For example, the control and management of the radio-related functions of an AP are described implicitly in the MIB, such as:
IEEE 802.11没有明确规定这些功能中的大多数，但有些功能是。例如，在MIB中隐含地描述了AP的无线电相关功能的控制和管理，例如：
o Channel Assignment
o 信道分配
o Transmit Power Control
o 发射功率控制
o Radio Resource Measurement (work is currently under way in IEEE 802.11k)
o 无线电资源测量（目前正在IEEE 802.11k中进行）
The 802.11h [5] amendment to the base 802.11 standard specifies the operation of a MAC management protocol to accomplish the requirements of some regulatory bodies (principally in Europe, but expanding to others) in the following areas:
基本802.11标准的802.11h[5]修正案规定了MAC管理协议的操作，以满足某些监管机构（主要在欧洲，但扩展到其他地区）在以下领域的要求：
o RADAR detection
o 雷达探测
o Transmit Power Control
o 发射功率控制
o Dynamic Channel Selection
o 动态信道选择
This document provides a taxonomy of the WLAN network architectures developed by the vendor community in an attempt to address some or all of the problems outlined in [2]. As the IEEE 802.11 standard purposely avoids specifying the details of DS implementations, different architectures have proliferated in the market. While all these different architectures conform to the IEEE 802.11 standard as a whole, their individual functional components are not standardized.
本文档提供了供应商社区为解决[2]中概述的部分或全部问题而开发的WLAN网络体系结构的分类。由于IEEE 802.11标准有意避免指定DS实现的细节，不同的体系结构在市场上大量出现。虽然所有这些不同的体系结构总体上符合IEEE 802.11标准，但它们各自的功能组件并未标准化。
Interfaces between the network architecture components are mostly proprietary, and there is no guarantee of cross-vendor interoperability of products, even within the same family of architectures.
网络体系结构组件之间的接口大部分是专有的，并且不能保证产品的跨供应商互操作性，即使在同一体系结构系列中也是如此。
To achieve interoperability in the market place, the IETF CAPWAP working group is first documenting both the functions and the network architectures currently offered by the existing WLAN vendors. The end result is this taxonomy document.
为了在市场上实现互操作性，IETF CAPWAP工作组首先记录了现有WLAN供应商目前提供的功能和网络架构。最终的结果是这个分类法文档。
After analyzing more than a dozen different vendors' architectures, we believe that the existing 802.11 WLAN access network architectures can be broadly categorized into three distinct families, based on the characteristics of the Distribution Systems that are employed to provide the 802.11 functions.
在分析了十几家不同供应商的体系结构后，我们认为，根据用于提供802.11功能的配电系统的特点，现有的802.11 WLAN接入网络体系结构可以大致分为三个不同的系列。
o Autonomous WLAN Architecture: The first architecture family is the traditional autonomous WLAN architecture, in which each WTP is a single physical device that implements all the 802.11 services, including both the distribution and integration services, and the portal function. Such an AP architecture is called Autonomous WLAN Architecture because each WTP is autonomous in its functionality, and no explicit 802.11 support is needed from devices other than the WTP. In such architecture, the WTP is typically configured and controlled individually, and can be monitored and managed via typical network management protocols like SNMP. The WTPs are the traditional APs with which most people are familiar. Such WTPs are sometimes referred to as "Fat APs" or "Standalone APs".
o 自主WLAN体系结构：第一个体系结构系列是传统的自主WLAN体系结构，其中每个WTP是实现所有802.11服务的单个物理设备，包括分发和集成服务以及门户功能。这样的AP架构被称为自治WLAN架构，因为每个WTP在其功能上是自治的，并且不需要来自除WTP以外的设备的明确的802.11支持。在这种体系结构中，WTP通常是单独配置和控制的，并且可以通过典型的网络管理协议（如SNMP）进行监视和管理。WTP是大多数人熟悉的传统AP。此类WTP有时被称为“Fat AP”或“独立AP”。
o Centralized WLAN Architecture: The second WLAN architecture family is an emerging hierarchical architecture utilizing one or more centralized controllers for managing a large number of WTP devices. The centralized controller is commonly referred to as an Access Controller (AC), whose main function is to manage, control, and configure the WTP devices that are present in the network. In addition to being a centralized entity for the control and management plane, it may also become a natural aggregation point for the data plane since it is typically situated in a centralized location in the wireless access network. The AC is often co-located with an L2 bridge, a switch, or an L3 router, and may be referred to as Access Bridge or Access Router in those particular cases. Therefore, an Access Controller could be either an L3 or L2 device, and is the generic term we use throughout this document. It is also possible that multiple ACs are present in a network for purposes of redundancy, load balancing, etc. This architecture family has several distinct characteristics that are worth noting. First, the hierarchical architecture and the
o 集中式WLAN体系结构：第二个WLAN体系结构系列是一种新兴的分层体系结构，使用一个或多个集中式控制器来管理大量WTP设备。集中式控制器通常被称为访问控制器（AC），其主要功能是管理、控制和配置网络中的WTP设备。除了作为控制和管理平面的集中实体之外，它还可以成为数据平面的自然聚合点，因为它通常位于无线接入网络中的集中位置。AC通常与L2网桥、交换机或L3路由器位于同一位置，并且在这些特定情况下可被称为接入网桥或接入路由器。因此，访问控制器可以是L3或L2设备，这是我们在本文档中使用的通用术语。出于冗余、负载平衡等目的，网络中也可能存在多个AC。此体系结构系列具有几个值得注意的显著特征。首先，层次结构和
centralized AC affords much better manageability for large scale networks. Second, since the IEEE 802.11 functions and the CAPWAP control functions are provided by the WTP devices and the AC together, the WTP devices themselves may no longer fully implement the 802.11 functions as defined in the standards. Therefore, it can be said that the full 802.11 functions are implemented across multiple physical network devices, namely, the WTPs and ACs. Since the WTP devices only implement a portion of the functions that standalone APs implement, WTP devices in this architecture are sometimes referred to as light weight or thin APs.
集中式AC为大规模网络提供了更好的可管理性。其次，由于IEEE 802.11功能和CAPWAP控制功能由WTP设备和AC一起提供，因此WTP设备本身可能不再完全实现标准中定义的802.11功能。因此，可以说，完整的802.11功能是跨多个物理网络设备实现的，即wtp和ACs。由于WTP设备仅实现独立AP实现的部分功能，因此此体系结构中的WTP设备有时被称为轻型或轻型AP。
o Distributed WLAN Architecture: The third emerging WLAN architecture family is the distributed architecture in which the participating wireless nodes are capable of forming a distributed network among themselves, via wired or wireless media. A wireless mesh network is one example within the distributed architecture family, where the nodes themselves form a mesh network and connect with neighboring mesh nodes via 802.11 wireless links. Some of these nodes also have wired Ethernet connections acting as gateways to the external network.
o 分布式WLAN体系结构：第三个新兴的WLAN体系结构系列是分布式体系结构，其中参与的无线节点能够通过有线或无线媒体在它们之间形成分布式网络。无线网状网络是分布式体系结构系列中的一个示例，其中节点本身形成网状网络并通过802.11无线链路与相邻网状节点连接。其中一些节点还具有有线以太网连接，充当到外部网络的网关。
Before the IETF CAPWAP working group started documenting the various WLAN architectures, we conducted an open survey soliciting WLAN architecture descriptions via the IETF CAPWAP mailing list. We provided the interested parties with a common template that included a number of questions about their WLAN architectures. We received 16 contributions in the form of short text descriptions answering those questions. 15 of them are from WLAN vendors (AireSpace, Aruba, Avaya, Chantry Networks, Cisco, Cranite Systems, Extreme Networks, Intoto, Janusys Networks, Nortel, Panasonic, Trapeze, Instant802, Strix Systems, Symbol) and one from the academic research community (UCLA). Out of the 16 contributions, one describes an Autonomous WLAN Architecture, three are Distributed Mesh Architectures, and the remaining twelve entries represent architectures in the family of the Centralized WLAN Architecture.
在IETF CAPWAP工作组开始记录各种WLAN架构之前，我们进行了一次公开调查，通过IETF CAPWAP邮件列表征求WLAN架构描述。我们向感兴趣的各方提供了一个通用模板，其中包括有关其WLAN架构的一些问题。我们收到了16份以简短文字描述的形式回答这些问题的稿件。其中15家来自WLAN供应商（AireSpace、Aruba、Avaya、Chantry Networks、Cisco、Cranite Systems、Extreme Networks、Intoto、Janusys Networks、北电、松下、吊架、Instant802、Strix Systems、Symbol），一家来自学术研究社区（UCLA）。在这16篇文章中，一篇描述了自主WLAN体系结构，三篇描述了分布式网状体系结构，其余12篇描述了集中式WLAN体系结构家族中的体系结构。
The main objective of this survey was to identify the general categories and trends in WLAN architecture evolution, discover their common characteristics, and determine what is performed differently among them and why. In order to represent the survey data in a compact format, a "Functional Distribution Matrix" is used in this document, (mostly in the Centralized WLAN architecture section), to tabulate the various services and functions in the vendors' offerings. These services and functions are classified into three main categories:
本次调查的主要目的是确定WLAN体系结构演变的一般类别和趋势，发现它们的共同特征，并确定它们之间的表现差异以及原因。为了以紧凑的格式表示调查数据，本文件中使用了“功能分布矩阵”（主要在集中式WLAN架构部分），以将供应商产品中的各种服务和功能制成表格。这些服务和功能分为三大类：
o Architecture Considerations: The choice of the connectivity between the AC and the WTP. The design choices regarding the physical device on which processing of management, control, and data frames of the 802.11 takes place.
o 架构注意事项：选择AC和WTP之间的连接。关于在其上进行802.11的管理、控制和数据帧的处理的物理设备的设计选择。
o 802.11 Functions: As described in Section 1.1.
o 802.11功能：如第1.1节所述。
o CAPWAP Functions: As described in Section 1.2.
o CAPWAP功能：如第1.2节所述。
For each one of these categories, the mapping of each individual function to network entities implemented by each vendor is shown in tabular form. The rows in the Functional Distribution Matrix represent individual functions that are organized into the above mentioned three categories. Each column of the Matrix represents one vendor's architecture offering in the survey data. See Figure 7 as an example of the Matrix.
对于这些类别中的每一个，每个单独功能到每个供应商实现的网络实体的映射以表格形式显示。功能分布矩阵中的行表示组织为上述三类的单个功能。矩阵的每一列代表调查数据中一个供应商的架构。参见图7作为矩阵示例。
This Functional Distribution Matrix is intended for the sole purpose of organizing the architecture taxonomy data, and represents the contributors' views of their architectures from an engineering perspective. It does not necessarily imply that a product exists or will be shipped, nor an intent by the vendor to build such a product.
此功能分布矩阵仅用于组织体系结构分类数据，并从工程角度表示贡献者对其体系结构的看法。这并不一定意味着产品已经存在或将要发运，也不意味着供应商有意制造这样的产品。
The next section provides a list of definitions used in this document. The rest of this document is organized around the three broad WLAN architecture families that were introduced in Section 1.3. Each architecture family is discussed in a separate section. The section on Centralized Architecture contains more in-depth details than the other two families, largely due to the large number of the survey data (twelve out of sixteen) collected that fall into the Centralized Architecture category. Summary and conclusions are provided at the end to highlight the basic findings from this taxonomy exercise.
下一节提供了本文档中使用的定义列表。本文档的其余部分围绕第1.3节介绍的三个广泛的WLAN体系结构系列进行组织。每个体系结构系列将在单独的一节中讨论。与其他两个系列相比，集中式体系结构部分包含了更深入的细节，这主要是因为收集到的大量调查数据（十六个数据中有十二个属于集中式体系结构类别）。最后提供了总结和结论，以突出本分类练习的基本发现。
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [3].
本文件中的关键词“必须”、“不得”、“要求”、“应”、“不应”、“应”、“不应”、“建议”、“可”和“可选”应按照RFC 2119[3]中所述进行解释。
Station (STA): A device that contains an IEEE 802.11 conformant medium access control (MAC) and physical layer (PHY) interface to the wireless medium (WM).
站点（STA）：包含符合IEEE 802.11的媒体访问控制（MAC）和无线媒体（WM）的物理层（PHY）接口的设备。
Access Point (AP): An entity that has station functionality and provides access to distribution services via the wireless medium (WM) for associated stations.
接入点（AP）：具有站点功能并通过无线媒体（WM）为相关站点提供对分发服务的访问的实体。
Basic Service Set (BSS): A set of stations controlled by a single coordination function.
基本服务集（BSS）：由单一协调功能控制的一组站点。
Station Service (SS): The set of services that support transport of medium access control (MAC) service data units (MSDUs) between stations within a basic service set (BSS).
站点服务（SS）：支持在基本服务集（BSS）内的站点之间传输媒体访问控制（MAC）服务数据单元（MSDU）的一组服务。
Distribution System (DS): A system used to interconnect a set of basic service sets (BSSs) and integrated local area networks (LANs) to create an extended service set (ESS).
配电系统（DS）：用于互连一组基本服务集（BSS）和集成局域网（LAN）以创建扩展服务集（ESS）的系统。
Extended Service Set (ESS): A set of one or more interconnected basic service sets (BSSs) with the same SSID and integrated local area networks (LANs), which appears as a single BSS to the logical link control layer at any station associated with one of those BSSs.
扩展服务集（ESS）：具有相同SSID和集成局域网（LAN）的一个或多个互连基本服务集（BSS）的集合，在与其中一个BSS相关联的任何站点的逻辑链路控制层上显示为单个BSS。
Portal: The logical point at which medium access control (MAC) service data units (MSDUs) from a non-IEEE 802.11 local area network (LAN) enter the distribution system (DS) of an extended service set (ESS).
入口：非IEEE 802.11局域网（LAN）的介质访问控制（MAC）服务数据单元（MSDU）进入扩展服务集（ESS）的配电系统（DS）的逻辑点。
Distribution System Service (DSS): The set of services provided by the distribution system (DS) that enable the medium access control (MAC) layer to transport MAC service data units (MSDUs) between stations that are not in direct communication with each other over a single instance of the wireless medium (WM). These services include the transport of MSDUs between the access points (APs) of basic service sets (BSSs) within an extended service set (ESS), transport of MSDUs between portals and BSSs within an ESS, and transport of MSDUs between stations in the same BSS in cases where the MSDU has a multicast or broadcast destination address, or where the destination is an individual address, but the station sending the MSDU chooses to involve DSS. DSSs are provided between pairs of IEEE 802.11 MACs.
配电系统服务（DSS）：配电系统（DS）提供的一组服务，使介质访问控制（MAC）层能够在不通过无线介质（WM）的单个实例彼此直接通信的站点之间传输MAC服务数据单元（MSDU）。这些服务包括在扩展服务集（ESS）内的基本服务集（BSS）的接入点（AP）之间传输MSDU，在ESS内的门户和BSS之间传输MSDU，以及在MSDU具有多播或广播目的地地址的情况下在同一BSS内的站点之间传输MSDU，或者，目的地是单个地址，但发送MSDU的站点选择使用DSS。DSS在成对的IEEE 802.11 MAC之间提供。
Integration: The service that enables delivery of medium access control (MAC) service data units (MSDUs) between the distribution system (DS) and an existing, non-IEEE 802.11 local area network (via a portal).
集成：在配电系统（DS）和现有的非IEEE 802.11局域网（通过入口）之间提供介质访问控制（MAC）服务数据单元（MSDU）的服务。
Distribution: The service that, by using association information, delivers medium access control (MAC) service data units (MSDUs) within the distribution system (DS).
分发：使用关联信息在分发系统（DS）内提供介质访问控制（MAC）服务数据单元（MSDU）的服务。
One of the motivations in defining new terminology is to clarify ambiguity and confusion surrounding some conventional terms. One such term is "Access Point (AP)". Typically, when people talk about "AP", they refer to the physical entity (box) that has an antenna, implements 802.11 PHY, and receives/transmits the station (STA) traffic over the air. However, the 802.11 Standard [1] describes the AP mostly as a logical entity that implements a set of logical services so that station traffic can be received and transmitted effectively over the air. When people refer to "AP functions", they usually mean the logical functions the whole WLAN access network supports, and not just the subset of functions supported by the physical entity (box) that the STAs communicate with directly. Such confusion can be especially acute when logical functions are implemented across a network instead of within a single physical entity. To avoid further confusion, we define the following terminology:
定义新术语的动机之一是澄清围绕某些常规术语的歧义和混淆。其中一个术语是“接入点（AP）”。通常，当人们谈论“AP”时，他们指的是具有天线、实现802.11 PHY并通过空中接收/发送站点（STA）业务的物理实体（框）。然而，802.11标准[1]主要将AP描述为实现一组逻辑服务的逻辑实体，以便可以通过空中有效地接收和传输站点通信量。当人们提到“AP功能”时，他们通常指的是整个WLAN接入网络支持的逻辑功能，而不仅仅是sta直接通信的物理实体（box）支持的功能子集。当逻辑功能跨网络而不是在单个物理实体内实现时，这种混淆可能会特别严重。为避免进一步混淆，我们定义了以下术语：
CAPWAP: Control and Provisioning of Wireless Access Points
CAPWAP：无线接入点的控制和配置
IEEE 802.11 WLAN Functions: A set of logical functions defined by the IEEE 802.11 Working Group, including all the MAC services, Station Services, and Distribution Services. These logical functions are required to be implemented in the IEEE 802.11 Wireless LAN (WLAN) access networks by the IEEE 802.11 Standard [1].
IEEE 802.11 WLAN功能：由IEEE 802.11工作组定义的一组逻辑功能，包括所有MAC服务、站点服务和分发服务。IEEE 802.11标准要求在IEEE 802.11无线局域网（WLAN）接入网络中实现这些逻辑功能[1]。
CAPWAP Functions: A set of WLAN control functions that are not directly defined by IEEE 802.11 Standards, but deemed essential for effective control, configuration, and management of 802.11 WLAN access networks.
CAPWAP功能：IEEE 802.11标准未直接定义的一组WLAN控制功能，但被认为对802.11 WLAN接入网络的有效控制、配置和管理至关重要。
Wireless Termination Point (WTP): The physical or network entity that contains an RF antenna and 802.11 PHY to transmit and receive station traffic for the IEEE 802.11 WLAN access networks. Such physical entities were often called "Access Points" (AP), but "AP" can also refer to the logical entity that implements 802.11 services. We recommend "WTP" as the generic term that explicitly refers to the physical entity with the above property (e.g., featuring an RF antenna and 802.11 PHY), applicable to network entities of both Autonomous and Centralized WLAN Architecture (see below).
无线终端点（WTP）：包含射频天线和802.11物理层的物理或网络实体，用于发送和接收IEEE 802.11 WLAN接入网络的站点流量。这种物理实体通常被称为“接入点”（AP），但“AP”也可以指实现802.11服务的逻辑实体。我们建议“WTP”作为通用术语，明确表示具有上述属性的物理实体（例如，具有射频天线和802.11物理层），适用于自主和集中式WLAN架构的网络实体（见下文）。
Autonomous WLAN Architecture: The WLAN access network architecture family in which all the logical functions, including both IEEE 802.11 and CAPWAP functions (wherever applicable), are implemented within each Wireless Termination Point (WTP) in the network. The WTPs in
自主WLAN体系结构：WLAN接入网络体系结构系列，其中所有逻辑功能，包括IEEE 802.11和CAPWAP功能（如适用），均在网络中的每个无线终端点（WTP）内实现。世界贸易组织
such networks are also called standalone APs, or fat APs, because these devices implement the full set of functions that enable the devices to operate without any other support from the network.
此类网络也称为独立AP或fat AP，因为这些设备实现了一整套功能，使设备能够在没有网络任何其他支持的情况下运行。
Centralized WLAN Architecture: The WLAN access network architecture family in which the logical functions, including both IEEE 802.11 and CAPWAP functions (wherever applicable), are implemented across a hierarchy of network entities. At the lower level are the WTPs, while at the higher level are the Access Controllers (ACs), which are responsible for controlling, configuring, and managing the entire WLAN access network.
集中式WLAN体系结构：WLAN接入网络体系结构系列，其中逻辑功能（包括IEEE 802.11和CAPWAP功能（如适用））在网络实体的层次结构中实现。较低级别的是WTP，而较高级别的是访问控制器（ACs），它们负责控制、配置和管理整个WLAN访问网络。
Distributed WLAN Architecture: The WLAN access network architecture family in which some of the control functions (e.g., CAPWAP functions) are implemented across a distributed network consisting of peer entities. A wireless mesh network can be considered an example of such an architecture.
分布式WLAN体系结构：WLAN接入网络体系结构系列，其中一些控制功能（如CAPWAP功能）在由对等实体组成的分布式网络上实现。无线网状网络可以被视为这种体系结构的示例。
Access Controller (AC): The network entity in the Centralized WLAN Architecture that provides WTPs access to the centralized hierarchical network infrastructure in the data plane, control plane, management plane, or a combination therein.
访问控制器（AC）：集中式WLAN体系结构中的网络实体，提供WTPs对数据平面、控制平面、管理平面或其中组合中的集中式分层网络基础设施的访问。
Standalone WTP: Refers to the WTP in Autonomous WLAN Architecture.
独立WTP：指自主WLAN架构中的WTP。
Controlled WTP: Refers to the WTP in Centralized WLAN Architecture.
受控WTP：指集中式WLAN架构中的WTP。
Split MAC Architecture: A subgroup of the Centralized WLAN Architecture whereby WTPs in such WLAN access networks only implement the delay sensitive MAC services (including all control frames and some management frames) for IEEE 802.11, while all the remaining management and data frames are tunnelled to the AC for centralized processing. The IEEE 802.11 MAC, as defined by IEEE 802.11 Standards in [1], is effectively split between the WTP and AC.
拆分MAC架构：集中式WLAN架构的一个子组，在此架构中，此类WLAN接入网络中的WTP仅实现IEEE 802.11的延迟敏感MAC服务（包括所有控制帧和一些管理帧），而所有剩余的管理帧和数据帧通过隧道传输到AC进行集中处理。IEEE 802.11 MAC由[1]中的IEEE 802.11标准定义，有效地在WTP和AC之间分割。
Remote MAC Architecture: A subgroup of the Centralized WLAN Architecture, where the entire set of 802.11 MAC functions (including delay-sensitive functions) is implemented at the AC. The WTP terminates the 802.11 PHY functions.
远程MAC体系结构：集中式WLAN体系结构的一个子组，其中整个802.11 MAC功能集（包括延迟敏感功能）在AC上实现。WTP终止802.11 PHY功能。
Local MAC Architecture: A subgroup of the Centralized WLAN Architecture, where the majority or entire set of 802.11 MAC functions (including most of the 802.11 management frame processing) are implemented at the WTP. Therefore, the 802.11 MAC stays intact and local in the WTP, along with PHY.
本地MAC体系结构：集中式WLAN体系结构的一个子组，其中大部分或整套802.11 MAC功能（包括大部分802.11管理帧处理）在WTP上实现。因此，802.11 MAC和PHY在WTP中保持完整和本地。
While some terminology has been used by vendors historically to describe "Access Points", we recommend deferring its use, in order to avoid further confusion. A list of such terms and the recommended new terminology is provided below:
虽然供应商历来使用一些术语来描述“接入点”，但我们建议推迟使用，以避免进一步混淆。下文列出了此类术语和建议的新术语：
Split WLAN Architecture: Use Centralized WLAN Architecture.
拆分WLAN架构：使用集中式WLAN架构。
Hierarchical WLAN Architecture: Use Centralized WLAN Architecture.
分层WLAN架构：使用集中式WLAN架构。
Standalone Access Point: Use Standalone WTP.
独立接入点：使用独立WTP。
Fat Access Point: Use Standalone WTP.
Fat访问点：使用独立的WTP。
Thin Access Point: Use Controlled WTP.
精简访问点：使用受控WTP。
Light weight Access Point: Use Controlled WTP.
轻型接入点：使用受控WTP。
Split AP Architecture: Use Local MAC Architecture.
拆分AP架构：使用本地MAC架构。
Antenna AP Architecture: Use Remote MAC Architecture.
天线AP架构：使用远程MAC架构。
Figure 1 shows an example network of the Autonomous WLAN Architecture. This architecture implements all the 802.11 functionality in a single physical device, the Wireless Termination Point (WTP). An embodiment of this architecture is a WTP that translates between 802.11 frames to/from its radio interface and 802.3 frames to/from an Ethernet interface. An 802.3 infrastructure that interconnects the Ethernet interfaces of different WTPs provides the distribution system. It can also provide portals for integrated 802.3 LAN segments.
图1显示了自治WLAN体系结构的示例网络。该体系结构在单个物理设备（无线终端点（WTP））中实现所有802.11功能。该架构的一个实施例是WTP，它在802.11帧到/来自其无线电接口和802.3帧到/来自以太网接口之间转换。将不同WTP的以太网接口互连的802.3基础设施提供了配电系统。它还可以为集成的802.3 LAN网段提供入口。
+---------------+ +---------------+ +---------------+
| 802.11 BSS 1 | | 802.11 BSS 2 | | 802.11 BSS 3 |
| ... | | ... | | ... |
| +-----+ | | +-----+ | | +-----+ |
+----| WTP |----+ +----| WTP |----+ +----| WTP |----+
+--+--+ +--+--+ +--+--+
|Ethernet | |
+------------------+ | +------------------+
| | |
+---+--+--+---+
| Ethernet |
802.3 LAN --------------+ Switch +-------------- 802.3 LAN
segment 1 | | segment 2
+------+------+
+---------------+ +---------------+ +---------------+
| 802.11 BSS 1 | | 802.11 BSS 2 | | 802.11 BSS 3 |
| ... | | ... | | ... |
| +-----+ | | +-----+ | | +-----+ |
+----| WTP |----+ +----| WTP |----+ +----| WTP |----+
+--+--+ +--+--+ +--+--+
|Ethernet | |
+------------------+ | +------------------+
| | |
+---+--+--+---+
| Ethernet |
802.3 LAN --------------+ Switch +-------------- 802.3 LAN
segment 1 | | segment 2
+------+------+
Figure 1: Example of Autonomous WLAN Architecture
图1：自治WLAN架构示例
A single physical WTP can optionally be provisioned as multiple virtual WTPs by supporting multiple SSIDs to which 802.11 clients may associate. In some cases, this will involve putting a corresponding 802.1Q VLAN tag on each packet forwarded to the Ethernet infrastructure and removing 802.1Q tags prior to forwarding the packets to the wireless medium.
通过支持802.11客户端可能关联的多个ssid，可以选择将单个物理WTP配置为多个虚拟WTP。在某些情况下，这将涉及在转发到以太网基础设施的每个数据包上放置相应的802.1Q VLAN标记，并在将数据包转发到无线媒体之前移除802.1Q标记。
The scope of the ESS(s) created by interconnecting the WTPs will be confined by the constraints imposed by the Ethernet infrastructure.
通过互连WTP创建的ESS的范围将受到以太网基础设施施加的限制。
Authentication of 802.11 clients may be performed locally by the WTP or by using a centralized authentication server.
802.11客户端的认证可以由WTP本地执行，也可以使用集中式认证服务器执行。
Since both the 802.11 and CAPWAP functions are tightly integrated into a single physical device, security issues with this architecture are confined to the WTP. There are no extra implications from the client authentication and encryption/decryption perspective, as the AAA interface and the key generation mechanisms required for 802.11i encryption/decryption are integrated into the WTP.
由于802.11和CAPWAP功能都紧密集成到单个物理设备中，因此此体系结构的安全问题仅限于WTP。由于802.11i加密/解密所需的AAA接口和密钥生成机制已集成到WTP中，因此从客户端身份验证和加密/解密的角度来看没有额外的含义。
One of the security needs in this architecture is for mutual authentication between the WTP and the Ethernet infrastructure. This can be ensured by existing mechanisms such as 802.1X between the WTP and the Ethernet switch to which it connects. Another critical security issue is the fact that the WTP is most likely not under lock and key, but contains secret information to communicate with back-end systems, such as AAA and SNMP. Because IT personnel uses the common management method of pushing a "template" to all devices, theft of such a device would potentially compromise the wired network.
该体系结构中的安全需求之一是WTP和以太网基础设施之间的相互认证。这可以通过WTP与其连接的以太网交换机之间的现有机制（如802.1X）来确保。另一个关键的安全问题是，WTP很可能不处于锁定和密钥下，但包含用于与后端系统（如AAA和SNMP）通信的机密信息。由于IT人员使用将“模板”推送到所有设备的通用管理方法，因此盗窃此类设备可能会危及有线网络。
Centralized WLAN Architecture is an emerging architecture family in the WLAN market. Contrary to the Autonomous WLAN Architecture, where the 802.11 functions and network control functions are all implemented within each Wireless Termination Point (WTP), the Centralized WLAN Architecture employs one or more centralized controllers, called Access Controller(s), to enable network-wide monitoring, improve management scalability, and facilitate dynamic configurability.
集中式WLAN体系结构是WLAN市场上一个新兴的体系结构系列。与自治WLAN体系结构相反，其中802.11功能和网络控制功能均在每个无线终端点（WTP）内实现，集中式WLAN体系结构使用一个或多个集中式控制器，称为接入控制器，以实现网络范围的监控，提高管理可伸缩性，并促进动态配置。
The following figure schematically shows the Centralized WLAN Architecture network diagram, where the Access Controller (AC) connects to multiple Wireless Termination Points (WTPs) via an interconnection medium. This can be a direct connection, an L2- switched, or an L3-routed network as described in Section 5.1. The AC exchanges configuration and control information with the WTP devices, allowing the management of the network from a centralized point. Designs of the Centralized WLAN Architecture family do not presume (as the diagram might suggest) that the AC necessarily intercedes in the data plane to/from the WTP(s). More details are provided later in this section.
下图示意性地显示了集中式WLAN体系结构网络图，其中接入控制器（AC）通过互连介质连接到多个无线终端点（WTP）。这可以是直接连接、二级交换或三级路由网络，如第5.1节所述。AC与WTP设备交换配置和控制信息，允许从集中点管理网络。集中式WLAN体系结构系列的设计不假定（如图所示）AC必须在数据平面中与WTP进行交互。本节后面将提供更多详细信息。
+---------------+ +---------------+ +---------------+
| 802.11 BSS 1 | | 802.11 BSS 2 | | 802.11 BSS 3 |
| ... | | ... | | ... |
| +-------+ | | +-------+ | | +-------+ |
+----| WTP |--+ +----| WTP |--+ +----| WTP |--+
+---+---+ +---+---+ +---+---+
| | |
+------------------+ | +-----------------+
| |...|
+----+--+---+--------+
| Interconnection |
+-------+------------+
|
|
+-----+----+
| AC |
+----------+
+---------------+ +---------------+ +---------------+
| 802.11 BSS 1 | | 802.11 BSS 2 | | 802.11 BSS 3 |
| ... | | ... | | ... |
| +-------+ | | +-------+ | | +-------+ |
+----| WTP |--+ +----| WTP |--+ +----| WTP |--+
+---+---+ +---+---+ +---+---+
| | |
+------------------+ | +-----------------+
| |...|
+----+--+---+--------+
| Interconnection |
+-------+------------+
|
|
+-----+----+
| AC |
+----------+
Figure 2: Centralized WLAN Architecture Diagram
图2：集中式WLAN架构图
In the diagram above, the AC is shown as a single physical entity that provides all of the CAPWAP functions listed in Section 1.2. However, this may not always be the case. Closer examination of the functions reveals that their different resource requirements (e.g., CPU, memory, storage) may be distributed across different devices. For instance, complex radio control algorithms can be CPU intensive. Storing and downloading images and configurations can be storage intensive. Therefore, different CAPWAP functions might be implemented on different physical devices due to the different nature of their resource requirements. The network entity marked 'AC' in the diagram above should be thought of as a multiplicity of logical functions, and not necessarily as a single physical device. The ACs may also choose to implement some control functions locally, and provide interfaces to access other global network management functions, which are typically implemented on separate boxes, such as a SNMP Network Management Station and an AAA back-end server (e.g., Radius Authentication Server).
在上图中，AC显示为单个物理实体，提供第1.2节中列出的所有CAPWAP功能。然而，情况并非总是如此。仔细检查这些功能可以发现，它们的不同资源需求（例如CPU、内存、存储）可能分布在不同的设备上。例如，复杂的无线电控制算法可能是CPU密集型的。存储和下载图像和配置可能是存储密集型的。因此，由于不同物理设备的资源需求性质不同，可能会在不同的物理设备上实现不同的CAPWAP功能。上图中标记为“AC”的网络实体应视为多个逻辑功能，而不一定是单个物理设备。ACs还可以选择在本地实现一些控制功能，并提供接口以访问其他全局网络管理功能，这些功能通常在单独的框上实现，例如SNMP网络管理站和AAA后端服务器（例如Radius认证服务器）。
There are several connectivity options to consider between the AC(s) and the WTPs, including direct connection, L2 switched connection, and L3 routed connection, as shown in Figures 3, 4, and 5.
在AC（S）和WTPS之间有几个连接选项，包括直接连接、L2交换连接和L3路由连接，如图3, 4和图5所示。
-------+------ LAN
|
+-------+-------+
| AC |
+----+-----+----+
| |
+---+ +---+
| |
+--+--+ +--+--+
| WTP | | WTP |
+--+--+ +--+--+
-------+------ LAN
|
+-------+-------+
| AC |
+----+-----+----+
| |
+---+ +---+
| |
+--+--+ +--+--+
| WTP | | WTP |
+--+--+ +--+--+
Figure 3: Directly Connected
图3：直接连接
-------+------ LAN
|
+-------+-------+
| AC |
+----+-----+----+
| |
+---+ +---+
| |
+--+--+ +-----+-----+
| WTP | | Switch |
+--+--+ +---+-----+-+
| |
+-----+ +-----+
| WTP | | WTP |
+-----+ +-----+
-------+------ LAN
|
+-------+-------+
| AC |
+----+-----+----+
| |
+---+ +---+
| |
+--+--+ +-----+-----+
| WTP | | Switch |
+--+--+ +---+-----+-+
| |
+-----+ +-----+
| WTP | | WTP |
+-----+ +-----+
Figure 4: Switched Connections
图4：交换连接
+-------+-------+
| AC |
+-------+-------+
|
--------+------ LAN
|
+-------+-------+
| Router |
+-------+-------+
|
-----+--+--+--- LAN
| |
+---+ +---+
| |
+--+--+ +--+--+
| WTP | | WTP|
+--+--+ +--+--+
+-------+-------+
| AC |
+-------+-------+
|
--------+------ LAN
|
+-------+-------+
| Router |
+-------+-------+
|
-----+--+--+--- LAN
| |
+---+ +---+
| |
+--+--+ +--+--+
| WTP | | WTP|
+--+--+ +--+--+
Figure 5: Routed Connections
图5：路由连接
Dynamic and consistent network management is one of the primary motivations for the Centralized Architecture. The survey data from vendors also shows that different varieties of this architecture family have emerged to meet a complex set of different requirements for various possible deployment scenarios. This is also a direct result of the inherent flexibility in the 802.11 standard [1] regarding the implementation of the logical functions that are
动态和一致的网络管理是集中式体系结构的主要动机之一。来自供应商的调查数据还显示，该体系结构系列的不同种类已经出现，以满足各种可能部署场景的一组复杂的不同需求。这也是802.11标准[1]在实现以下逻辑功能方面固有灵活性的直接结果：
broadly described under the term "Access Point (AP)". Because there is no standard mapping of these AP functions to physical network entities, several design choices have been made by vendors that offer related products. Moreover, the increased demand for monitoring and consistent configuration of large wireless networks has resulted in a set of 'value-added' services provided by the various vendors, most of which share common design properties and service goals.
在术语“接入点（AP）”下进行广泛描述。由于这些AP功能没有标准映射到物理网络实体，因此提供相关产品的供应商已经做出了一些设计选择。此外，对大型无线网络的监控和一致性配置的需求不断增加，导致各供应商提供了一套“增值”服务，其中大多数具有共同的设计属性和服务目标。
In the following, we describe the three main variants observed from the survey data within the family of Centralized WLAN Architecture, namely the Local MAC, Split MAC, and Remote MAC approaches. For each approach, we provide the mapping characteristics of the various functions into the network entities from each vendor. The naming of Local MAC, Split MAC, and Remote MAC reflects how the functions, and especially the 802.11 MAC functions, are mapped onto the network entities. Local MAC indicates that the MAC functions stay intact and local to WTPs, while Remote MAC denotes that the MAC has moved away from the WTP to a remote AC in the network. Split MAC shows the MAC being split between the WTPs and ACs, largely along the line of realtime sensitivity. Typically, Split MAC vendors choose to put realtime functions on the WTPs while leaving non-realtime functions to the ACs. 802.11 does not clearly specify what constitutes realtime functions versus non-realtime functions, and so a clear and definitive line does not exist. As shown in Section 5.4, each vendor has its own interpretation on this, and there are some discrepancies about where to draw the line between realtime and non-realtime functions. However, vendors agree on the characterization of the majority of MAC functions. For example, every vendor classifies the DCF as a realtime function.
在下文中，我们描述了从集中式WLAN体系结构系列中的调查数据中观察到的三种主要变体，即本地MAC、拆分MAC和远程MAC方法。对于每种方法，我们都提供了各种功能到每个供应商的网络实体的映射特征。本地MAC、拆分MAC和远程MAC的命名反映了功能，尤其是802.11 MAC功能如何映射到网络实体上。本地MAC表示MAC功能保持完整且在WTP本地，而远程MAC表示MAC已从WTP移动到网络中的远程AC。Split MAC显示在WTP和ACs之间拆分的MAC，主要是沿着实时敏感度线。通常，拆分MAC供应商选择将实时功能放在WTP上，而将非实时功能留给ACs。802.11没有明确规定实时功能与非实时功能的构成，因此不存在明确明确的界线。如第5.4节所示，每个供应商对此有自己的解释，在实时和非实时功能之间的界限上存在一些差异。然而，供应商同意大多数MAC功能的特性。例如，每个供应商都将DCF分类为实时功能。
The differences among Local MAC, Split MAC and Remote MAC architectures are shown graphically in the following figure:
本地MAC、拆分MAC和远程MAC架构之间的差异如下图所示：
+--------------+--- +---------------+--- +--------------+---
| CAPWAP | | CAPWAP | | CAPWAP |
| functions |AC | functions |AC | functions |
|==============|=== |---------------| |--------------|
| | | non RT MAC | | |AC
| 802.11 MAC | |===============|=== | 802.11 MAC |
| |WTP | Realtime MAC | | |
|--------------| |---------------|WTP |==============|===
| 802.11 PHY | | 802.11 PHY | | 802.11 PHY |WTP
+--------------+--- +---------------+--- +--------------+---
+--------------+--- +---------------+--- +--------------+---
| CAPWAP | | CAPWAP | | CAPWAP |
| functions |AC | functions |AC | functions |
|==============|=== |---------------| |--------------|
| | | non RT MAC | | |AC
| 802.11 MAC | |===============|=== | 802.11 MAC |
| |WTP | Realtime MAC | | |
|--------------| |---------------|WTP |==============|===
| 802.11 PHY | | 802.11 PHY | | 802.11 PHY |WTP
+--------------+--- +---------------+--- +--------------+---
(a) "Local MAC" (b) "Split MAC" (c) "Remote MAC"
(a) “本地MAC”（b）“分割MAC”（c）“远程MAC”
Figure 6: Three Architectural Variants within the Centralized WLAN Architecture Family
图6：集中式WLAN体系结构系列中的三种体系结构变体
The main motivation of the Local MAC architecture model, as shown in Figure 6 (a), is to offload network access policies and management functions (CAPWAP functions described in Section 1.2) to the AC without splitting the 802.11 MAC functionality between WTPs and AC. The whole 802.11 MAC resides on the WTPs locally, including all the 802.11 management and control frame processing for the STAs. On the other hand, information related to management and configuration of the WTP devices is communicated with a centralized AC to facilitate management of the network and maintain a consistent network-wide configuration for the WTP devices.
如图6（a）所示，本地MAC架构模型的主要动机是将网络访问策略和管理功能（第1.2节中描述的CAPWAP功能）卸载到AC，而不在WTP和AC之间拆分802.11 MAC功能。整个802.11 MAC驻留在WTP本地，包括STA的所有802.11管理和控制帧处理。另一方面，与WTP设备的管理和配置相关的信息与集中式AC通信，以促进网络的管理并维护WTP设备的一致的网络范围配置。
Figure 7 shows a tabular representation of the design choices made by the six vendors in the survey that follow the Local MAC approach, with respect to the above mentioned architecture considerations. "WTP-AC connectivity" shows the type connectivity between the WTPs and AC that every vendor's architecture can support. Clearly, all the vendors can support L3 routed network connectivity between WTPs and the AC, which implies that direct connections and L2 switched networks are also supported by all vendors. By '802.11 mgmt termination', and '802.11 control termination', we denote the physical network device on which processing of the 802.11 management and control frames is done respectively. All the vendors here choose to terminate 802.11 management and control frames at the WTPs. The last row of the table, '802.11 data aggregation', refers to the device on which aggregation and delivery of 802.11 data frames from one STA to another (possibly through a DS) is performed. As shown by the table, vendors make different choices as to whether all the 802.11 data traffic is aggregated and routed through the AC. The survey data shows that some vendors choose to tunnel or encapsulate all the station traffic to or from the ACs, implying that the AC also acts as the access router for this WLAN access network. Other vendors choose to separate the control and data plane by letting the station traffic be bridged or routed locally, while keeping the centralized control at the AC.
图7显示了六家供应商在调查中所做的设计选择的表格，这六家供应商遵循本地MAC方法，考虑到上述架构考虑。“WTP-AC连接”显示了每个供应商的体系结构都可以支持的WTP和AC之间的连接类型。显然，所有供应商都可以支持WTP和AC之间的L3路由网络连接，这意味着所有供应商也支持直接连接和L2交换网络。通过“802.11管理终止”和“802.11控制终止”，我们表示分别在其上进行802.11管理和控制帧处理的物理网络设备。这里的所有供应商都选择在WTP上终止802.11管理和控制帧。表的最后一行“802.11数据聚合”是指在其上执行802.11数据帧从一个STA到另一个STA（可能通过DS）的聚合和传递的设备。如表所示，供应商对所有802.11数据流量是否通过AC聚合和路由做出了不同的选择。调查数据显示，一些供应商选择隧道或封装所有进出ACs的站点流量，这意味着AC还充当此WLAN接入网络的接入路由器。其他供应商选择通过让站点流量在本地桥接或路由来分离控制和数据平面，同时将集中控制保持在AC。
Arch7 Arch8 Arch9 Arch10 Arch11
----- ----- ----- ------ ------
WTP-AC
connectivity L3 L3 L3 L3 L3
Arch7 Arch8 Arch9 Arch10 Arch11
----- ----- ----- ------ ------
WTP-AC
connectivity L3 L3 L3 L3 L3
802.11 mgmt termination WTP WTP WTP WTP WTP
802.11管理终端WTP WTP WTP WTP WTP WTP
802.11 control termination WTP WTP WTP WTP WTP
802.11控制终端WTP WTP WTP WTP WTP
802.11 data aggregation AC AC WTP AC WTP
802.11数据聚合AC WTP AC WTP
Figure 7: Architecture Considerations for Local MAC Architecture
图7：本地MAC架构的架构注意事项
Figure 8 reveals that most of the CAPWAP functions, as described in Section 1.2, are implemented at the AC with help from WTPs to monitor RF channels, and collect statistics and state information from the STAs, as the AC offers the advantages of network-wide visibility, which is essential for many of the control, configuration, and value-added services.
图8显示，如第1.2节所述，大多数CAPWAP功能在WTPs的帮助下在AC实现，以监控射频信道，并从STA收集统计数据和状态信息，因为AC具有网络范围可视性的优势，这对于许多控制、配置和维护是必不可少的，以及增值服务。
Arch7 Arch8 Arch9 Arch10 Arch11
----- ----- ----- ------ ------
RF
Monitoring WTP WTP AC/WTP WTP WTP
Arch7 Arch8 Arch9 Arch10 Arch11
----- ----- ----- ------ ------
RF
Monitoring WTP WTP AC/WTP WTP WTP
RF Config. AC AC AC AC AC
射频配置。交-交-交-交
WTP config. AC AC AC AC AC
WTP配置。交-交-交-交
WTP Firmware AC AC AC AC AC
WTP固件AC
STA state info database AC AC/WTP AC/WTP AC/WTP AC
STA状态信息数据库AC AC/WTP AC/WTP AC/WTP AC
AC/WTP
mutual
authent. AC/WTP AC/WTP AC/WTP AC/WTP AC/WTP
AC/WTP
mutual
authent. AC/WTP AC/WTP AC/WTP AC/WTP AC/WTP
Figure 8: Mapping of CAPWAP Functions for Local MAC Architecture
图8：本地MAC架构的CAPWAP功能映射
The matrix in Figure 9 shows that most of the 802.11 functions are implemented at the WTPs for Local MAC Architecture, with some minor differences among the vendors regarding distribution service, 802.11e scheduling, and 802.1X/EAP authentication. The difference in distribution service is consistent with that described earlier regarding "802.11 data aggregation" in Figure 7.
图9中的矩阵显示，大多数802.11功能在本地MAC架构的WTP上实现，供应商之间在分发服务、802.11e调度和802.1X/EAP身份验证方面存在一些细微差异。分发服务中的差异与前面关于图7中“802.11数据聚合”的描述一致。
Arch7 Arch8 Arch9 Arch10 Arch11
----- ----- ----- ------ ------
Distribution
Service AC AC WTP AC WTP
Arch7 Arch8 Arch9 Arch10 Arch11
----- ----- ----- ------ ------
Distribution
Service AC AC WTP AC WTP
Integration Service WTP WTP WTP WTP WTP
集成服务
Beacon Generation WTP WTP WTP WTP WTP
信标生成
Probe Response WTP WTP WTP WTP WTP
探头响应WTP WTP WTP WTP WTP WTP
Power mgmt Packet Buffering WTP WTP WTP WTP WTP
功率管理数据包缓冲
Fragmentation/ Defragment. WTP WTP WTP WTP WTP
碎片整理/碎片整理。水处理厂水处理厂水处理厂水处理厂水处理厂
Association Disassoc. Reassociation AC WTP WTP WTP WTP
协会解散。重新关联AC WTP WTP WTP WTP WTP
WME/11e
--------------
classifying AC WTP
WME/11e
--------------
classifying AC WTP
scheduling WTP AC/WTP WTP WTP WTP
调度WTP AC/WTP WTP WTP WTP WTP
queuing WTP WTP WTP WTP
排队
Authentication
and Privacy
--------------
802.1X/EAP AC AC AC/WTP AC AC/WTP
Authentication
and Privacy
--------------
802.1X/EAP AC AC AC/WTP AC AC/WTP
Keys Management AC AC WTP AC AC
密钥管理AC WTP AC AC
802.11 Encryption/ Decryption WTP WTP WTP WTP WTP
802.11加密/解密WTP WTP WTP WTP WTP
Figure 9: Mapping of 802.11 Functions for Local MAC Architecture
图9：本地MAC架构的802.11功能映射
From Figures 7, 8, and 9, it is clear that differences among vendors in the Local MAC Architecture are relatively minor, and most of the functional mapping appears to be common across vendors.
从图7、图8和图9可以清楚地看出，本地MAC体系结构中供应商之间的差异相对较小，大多数功能映射似乎在供应商之间很常见。
As depicted in Figure 6 (b), the main idea behind the Split MAC architecture is to implement part of the 802.11 MAC functionality on a centralized AC instead of the WTPs, in addition to providing the required services for managing and monitoring the WTP devices. Usually, the decision of which functions of the 802.11 MAC need to be provided by the AC is based on the time-criticality of the services considered.
如图6（b）所示，除了提供管理和监控WTP设备所需的服务外，拆分MAC体系结构背后的主要思想是在集中式AC而不是WTP上实现802.11 MAC功能的一部分。通常，AC需要提供802.11 MAC的哪些功能的决定基于所考虑的服务的时间关键性。
In the Split MAC architecture, the WTP terminates the infrastructure side of the wireless physical link, provides radio-related management, and also implements time-critical functionality of the 802.11 MAC. In addition, the non-realtime management functions are handled by a centralized AC, along with higher level services, such as configuration, QoS, policies for load balancing, and access control lists. The key distinction between Local MAC and Split MAC relates to non-realtime functions: in Split MAC architecture, the AC terminates 802.11 non realtime functions, whereas in Local MAC architecture, the WTP terminates the 802.11 non-realtime functions and consequently sends appropriate messages to the AC.
在分割MAC架构中，WTP终止无线物理链路的基础设施端，提供与无线电相关的管理，并且还实现802.11 MAC的时间关键功能。此外，非实时管理功能由集中式AC处理，以及更高级别的服务，如配置、QoS、负载平衡策略和访问控制列表。本地MAC和拆分MAC之间的关键区别与非实时功能有关：在拆分MAC体系结构中，AC终止802.11非实时功能，而在本地MAC体系结构中，WTP终止802.11非实时功能，并因此向AC发送适当的消息。
There are several motivations for taking the Split MAC approach. The first is to offload functionality that is specific and relevant only to the locality of each BSS to the WTP, in order to allow the AC to scale to a large number of 'light weight' WTP devices. Moreover, realtime functionality is subject to latency constraints and cannot tolerate delays due to transmission of 802.11 control frames (or other realtime information) over multiple-hops. The latter would limit the available choices for connectivity between the AC and the
采用拆分MAC方法有几个动机。第一个是将特定且仅与每个BSS的位置相关的功能卸载到WTP，以便允许AC扩展到大量“轻型”WTP设备。此外，实时功能受延迟限制，并且不能容忍由于多跳传输802.11控制帧（或其他实时信息）而导致的延迟。后者将限制AC和之间可用的连接选择
WTP. Therefore, the realtime criterion is usually employed to separate MAC services between the devices. Another consideration is cost reduction of the WTP to make it as cheap and simple as possible. Finally, moving functions like encryption and decryption to the AC reduces vulnerabilities from a compromised WTP, since user encryption keys no longer reside on the WTP. As a result, any advancements in security protocol and algorithm designs do not necessarily obsolete the WTPs; the ACs implement the new security schemes instead, which simplifies the management and update task. Additionally, the network is protected against LAN-side eavesdropping.
WTP。因此，实时标准通常用于在设备之间分离MAC服务。另一个考虑因素是降低水处理厂的成本，使其尽可能便宜和简单。最后，将加密和解密等功能移动到AC可减少受损WTP的漏洞，因为用户加密密钥不再驻留在WTP上。因此，安全协议和算法设计的任何进步都不一定会淘汰WTP；ACs实现了新的安全方案，从而简化了管理和更新任务。此外，网络还受到保护，以防局域网侧窃听。
Since there is no clear definition in the 802.11 specification as to which 802.11 MAC functions are considered "realtime", each vendor interprets this in their own way. Most vendors agree that the following services of 802.11 MAC are examples of realtime services, and are chosen to be implemented on the WTPs.
由于802.11规范中没有明确定义哪些802.11 MAC功能被视为“实时”，因此每个供应商都以自己的方式对此进行解释。大多数供应商都同意802.11 MAC的以下服务是实时服务的示例，并选择在WTP上实现。
o Beacon Generation
o 信标生成
o Probe Response/Transmission
o 探头响应/传输
o Processing of Control Frames: RTS/CTS/ACK/PS-Poll/CF-End/CF-ACK
o 控制帧处理：RTS/CTS/ACK/PS轮询/CF结束/CF-ACK
o Synchronization
o 同步
o Retransmissions
o 重发
o Transmission Rate Adaptation
o 传输速率自适应
The following list includes examples of non-realtime MAC functions as interpreted by most vendors:
以下列表包括大多数供应商解释的非实时MAC功能示例：
o Authentication/De-authentication
o 身份验证/取消身份验证
o Association/Disassociation/Reassociation/Distribution
o 关联/解除关联/重新关联/分配
o Integration Services: Bridging between 802.11 and 802.3
o 集成服务：802.11和802.3之间的桥接
o Privacy: 802.11 Encryption/Decryption
o 隐私：802.11加密/解密
o Fragmentation/Defragmentation
o 碎片/碎片整理
However, some vendors may choose to classify some of the above "non-realtime" functions as realtime functions in order to support specific applications with strict QoS requirements. For example, Reassociation is sometimes implemented as a "realtime" function to support VoIP applications.
但是，一些供应商可能会选择将上述一些“非实时”功能归类为实时功能，以支持具有严格QoS要求的特定应用程序。例如，重新关联有时被实现为“实时”功能，以支持VoIP应用程序。
The non-realtime aspects of the 802.11 MAC are handled by the AC through the processing of raw 802.11 management frames (Split MAC). The following matrix in Figure 10 offers a tabular representation of the design choices made by the six vendors that follow the Split MAC design regarding the architecture considerations. While most vendors support L3 connectivity between WTPs and ACs, some can only support L2 switched connections due to the tighter delay constraint resulting from splitting MAC between two physical entities across a network. In Figure 7, it is clear that the WTP processes the 802.11 control frames in both the Split MAC and Local MAC. The difference between the two lies in the termination point for 802.11 management frames. Local MAC terminates 802.11 management frames at WTP, while at least some of the 802.11 management frames are terminated at the AC for the Split MAC Architecture. Since in most cases WTP devices are IP-addressable, any of the direct connection, L2-switched, or L3-routed connections of Section 1.2 can be used. If only Ethernet-encapsulation is performed (e.g., as in Architecture 4), then only direct connection and L2-switched connections are supported.
AC通过处理原始802.11管理帧（分割MAC）来处理802.11 MAC的非实时方面。图10中的以下矩阵以表格形式表示了六家遵循拆分MAC设计的供应商在架构考虑方面所做的设计选择。虽然大多数供应商支持WTP和ACs之间的L3连接，但由于在网络上的两个物理实体之间拆分MAC会产生更严格的延迟约束，一些供应商只能支持L2交换连接。在图7中，很明显，WTP在分割MAC和本地MAC中处理802.11控制帧。两者之间的区别在于802.11管理帧的终止点。本地MAC在WTP处终止802.11管理帧，而对于分割MAC架构，至少一些802.11管理帧在AC处终止。因为在大多数情况下，WTP设备是IP可寻址的，所以可以使用第1.2节中的任何直接连接、L2交换或L3路由连接。如果仅执行以太网封装（例如，如体系结构4），则仅支持直接连接和L2交换连接。
Arch1 Arch2 Arch3 Arch4 Arch5 Arch6
----- ----- ----- ----- ----- -----
WTP-AC
connectivity L3 L3 L3 L2 L3 L3
Arch1 Arch2 Arch3 Arch4 Arch5 Arch6
----- ----- ----- ----- ----- -----
WTP-AC
connectivity L3 L3 L3 L2 L3 L3
802.11 mgmt termination AC AC AC AC AC/WTP AC
802.11管理终端AC/WTP AC
802.11 control termination WTP WTP WTP WTP WTP WTP
802.11控制终端WTP WTP WTP WTP WTP WTP WTP
802.11 data aggregation AC AC AC AC AC AC
802.11数据聚合AC
Figure 10: Architecture Considerations for Split MAC Architecture
图10：拆分MAC架构的架构注意事项
Similar to the Local MAC Architecture, the matrix in Figure 11 shows that most of the CAPWAP control functions are implemented at the AC. The exception is RF monitoring, and in some cases RF configuration, which are performed locally at the WTPs.
与本地MAC架构类似，图11中的矩阵显示，大多数CAPWAP控制功能在AC上实现。例外情况是射频监控，在某些情况下，射频配置在WTP上本地执行。
Arch1 Arch2 Arch3 Arch4 Arch5 Arch6
----- ----- ----- ----- ----- -----
RF
Monitoring WTP WTP WTP WTP WTP WTP
Arch1 Arch2 Arch3 Arch4 Arch5 Arch6
----- ----- ----- ----- ----- -----
RF
Monitoring WTP WTP WTP WTP WTP WTP
RF Config. AC/WTP AC/WTP AC AC AC
射频配置。AC/WTP AC/WTP AC
WTP config. AC AC AC AC AC
WTP配置。交-交-交-交
WTP Firmware AC AC AC AC AC
WTP固件AC
STA state info database AC AC AC AC AC
STA状态信息数据库AC
AC/WTP
mutual
authent. AC/WTP AC/WTP AC/WTP AC/WTP
AC/WTP
mutual
authent. AC/WTP AC/WTP AC/WTP AC/WTP
Figure 11: Mapping of CAPWAP Functions for Split MAC Architecture
图11：拆分MAC架构的CAPWAP功能映射
The most interesting matrix for Split MAC Architecture is the Functional Distribution Matrix for 802.11 functions, as shown below in Figure 12. Vendors map the functions onto the WTPs and AC with a certain regularity. For example, all vendors choose to implement Distribution, Integration Service at the AC, along with 802.1X/EAP authentication and keys management. All vendors also choose to implement beacon generation at WTPs. On the other hand, vendors sometimes choose to map many of the other functions differently. Therefore, Split MAC Architectures are not consistent regarding the exact way the MAC is split.
拆分MAC体系结构最有趣的矩阵是802.11功能的功能分布矩阵，如下图12所示。供应商以一定的规律性将功能映射到WTP和AC上。例如，所有供应商都选择在AC实现分发、集成服务，以及802.1X/EAP身份验证和密钥管理。所有供应商也选择在WTPs上实现信标生成。另一方面，供应商有时会选择以不同的方式映射许多其他功能。因此，拆分MAC架构在MAC拆分的确切方式上并不一致。
Arch1 Arch2 Arch3 Arch4 Arch5 Arch6
----- ----- ----- ------ ----- -----
Distribution
Service AC AC AC AC AC AC
Arch1 Arch2 Arch3 Arch4 Arch5 Arch6
----- ----- ----- ------ ----- -----
Distribution
Service AC AC AC AC AC AC
Integration Service AC AC AC AC AC AC
集成服务AC
Beacon Generation WTP WTP WTP WTP WTP WTP
信标生成
Probe Response WTP AC/WTP WTP WTP WTP WTP
探头响应WTP AC/WTP WTP WTP WTP WTP WTP
Power mgmt Packet Buffering WTP WTP WTP AC AC/WTP WTP
功率管理数据包缓冲WTP WTP WTP AC/WTP WTP
Fragmentation Defragment. WTP WTP AC AC AC
碎片整理。水处理厂
Association Disassoc. Reassociation AC AC AC AC WTP AC
协会解散。重新关联AC WTP AC
WME/11e
--------------
classifying AC AC AC AC
WME/11e
--------------
classifying AC AC AC AC
scheduling WTP/AC AC WTP AC AC WTP/AC
调度WTP/AC WTP AC WTP/AC
queuing WTP/AC WTP WTP AC WTP WTP
排队WTP/AC WTP WTP AC WTP WTP
Authentication
and Privacy
--------------
Authentication
and Privacy
--------------
802.1X/EAP AC AC AC AC AC AC
802.1X/EAP AC
Keys Management AC AC AC AC AC AC
钥匙管理AC
802.11 Encryption/ Decryption WTP AC WTP AC AC AC
802.11加密/解密WTP AC WTP AC
Figure 12: Mapping of 802.11 Functions for Split MAC Architecture
图12：分割MAC架构的802.11功能映射
One of the main motivations for the Remote MAC Architecture is to keep the WTPs as light weight as possible, by having only the radio interfaces on the WTPs and offloading the entire set of 802.11 MAC functions (including delay-sensitive ones) to the Access Controller. This leaves all the complexities of the MAC and other CAPWAP control functions to the centralized controller.
远程MAC体系结构的主要动机之一是通过在WTP上仅具有无线电接口并将整套802.11 MAC功能（包括延迟敏感功能）卸载到接入控制器，使WTP尽可能轻。这将MAC和其他CAPWAP控制功能的所有复杂性留给了中央控制器。
The WTP acts only as a pass-through between the Wireless LAN clients (STA) and the AC, though they may have an additional feature to convert the frames from one format (802.11) to the other (i.e., Ethernet, TR, Fiber). The centralized controller provides network monitoring, management and control, an entire set of 802.11 AP services, security features, resource management, channel selection features, and guarantees Quality of Service to the users. Because the MAC is separated from the PHY, we call this the "Remote MAC Architecture". Typically, such architecture is deployed with special attention to the connectivity between the WTPs and AC so that the delay is minimized. The Radio over Fiber (RoF) from Architecture 5 is an example of Remote MAC Architecture.
WTP仅作为无线LAN客户端（STA）和AC之间的直通，尽管它们可能具有将帧从一种格式（802.11）转换为另一种格式（即以太网、TR、光纤）的附加功能。集中式控制器提供网络监控、管理和控制、一整套802.11 AP服务、安全功能、资源管理、信道选择功能，并保证用户的服务质量。因为MAC和PHY是分开的，所以我们称之为“远程MAC架构”。通常，部署此类体系结构时特别注意WTP和AC之间的连接，以便将延迟降至最低。来自架构5的光纤无线电（RoF）是远程MAC架构的一个示例。
Two commonalities across all three Centralized Architectures (Local MAC, Split MAC, and Remote MAC) are:
所有三种集中式体系结构（本地MAC、拆分MAC和远程MAC）的两个共同点是：
o Most of the CAPWAP functions related to network control and configuration reside on the AC.
o 大多数与网络控制和配置相关的CAPWAP功能都位于AC上。
o IEEE 802.11 PHY resides on the WTP.
o IEEE 802.11物理层驻留在WTP上。
There is a clear difference between Remote MAC and the other two Centralized Architectures (namely, Local MAC and Split MAC), as the 802.11 MAC is completely separated from the PHY in the former, while the other two keep some portion of the MAC functions together with PHY at the WTPs. The implication of PHY and MAC separation is that it severely limits the kind of interconnection between WTPs and ACs, so that the 802.11 timing constraints are satisfied. As pointed out earlier, this usually results in tighter constraint over the interconnection between WTP and AC for the Remote MAC Architecture. The advantage of Remote MAC Architecture is that it offers the lightest possible WTPs for certain deployment scenarios.
远程MAC与其他两种集中式架构（即本地MAC和拆分MAC）之间存在明显区别，因为802.11 MAC与前者中的PHY完全分离，而其他两种在WTP中将部分MAC功能与PHY一起保留。PHY和MAC分离的含义是，它严重限制了WTP和ACs之间的互连类型，从而满足802.11定时约束。如前所述，对于远程MAC架构，这通常会导致WTP和AC之间的互连受到更严格的约束。远程MAC体系结构的优势在于，它为某些部署场景提供了尽可能轻的WTP。
The commonalities and differences between Local MAC and Split MAC are most clearly seen by comparing Figure 7 to Figure 10. The commonality is that 802.11 control frames are terminated at WTPs in both cases. The main difference between Local MAC and Split MAC is that the WTP terminates only the 802.11 control frames in the Split MAC, while the WTP may terminate all 802.11 frames in the Local MAC. An interesting consequence of this difference is that the Integration Service, which essentially refers to bridging between 802.11 and 802.3 frames, is implemented by the AC in the Split MAC and by the WTP in the Local MAC, as shown in Figures 9 and 12, respectively.
通过比较图7和图10，可以最清楚地看到本地MAC和拆分MAC之间的共性和差异。共同点是，在这两种情况下，802.11控制帧都在WTP处终止。本地MAC和分割MAC之间的主要区别在于，WTP仅终止分割MAC中的802.11控制帧，而WTP可终止本地MAC中的所有802.11帧。这种差异的一个有趣的结果是，集成服务（本质上是指802.11和802.3帧之间的桥接）由分割MAC中的AC和本地MAC中的WTP实现，分别如图9和图12所示。
As a second note, the Distribution Service, although usually provided by the AC, can also be implemented at the WTP in some Local MAC architectures. This approach is meant to increase performance in delivering STAs data traffic by avoiding tunneling it to the AC, and relaxing the dependency of the WTP from the AC. Therefore, it is possible for the data and control planes to be separated in the Local MAC Architecture.
作为第二个注意事项，尽管分发服务通常由AC提供，但也可以在一些本地MAC架构中的WTP处实现。该方法旨在通过避免将STAs数据流量隧道传输到AC，并放松WTP对AC的依赖性，从而提高传输STAs数据流量的性能。因此，在本地MAC体系结构中，数据和控制平面可以分离。
Even though all the 802.11 traffic is aggregated at ACs in the case of Split MAC Architecture, the data and control planes can still be separated by employing multiple ACs. For example, one AC can implement most of the CAPWAP functions (control plane), while other ACs can be used for 802.11 frames bridging (data plane).
即使在分离MAC架构的情况下，所有802.11通信量在ACs处聚合，数据和控制平面仍然可以通过采用多个ACs来分离。例如，一个AC可以实现大多数CAPWAP功能（控制平面），而其他AC可以用于802.11帧桥接（数据平面）。
Each of the three architectural variants may be advantageous for certain deployment scenarios. While the Local MAC retains most of the STA's state information at the local WTPs, Remote MAC centralizes most of the state into the back-end AC. Split MAC sits somewhat in the middle of this spectrum, keeping some state information locally at the WTPs, and the rest centrally at the AC. Many factors should be taken into account to determine the exact balance desired between the centralized and decentralized state. The impact of such balance on network manageability is currently a matter of dispute within the technical community.
三种体系结构变体中的每一种都可能对某些部署场景有利。虽然本地MAC保留大部分的STA的状态信息在本地WTPS，远程MAC集中大部分状态到后端AC。分裂MAC坐在某种程度上在该频谱的中间，保持一些状态信息本地在WTPS，而其余的则集中在AC。在确定中央和分散状态之间的精确平衡时，应考虑许多因素。这种平衡对网络可管理性的影响目前在技术界存在争议。
Before any messages can be exchanged between an AC and WTP, the WTP needs to discover, authenticate, and register with the AC first, then download the firmware and establish a control channel with the AC. Message exchanges between the WTP and AC for control and configuration can happen after that. The following list outlines the basic operations that are typically performed between the WTP and the AC in their typical order:
在AC和WTP之间交换任何消息之前，WTP需要首先发现、验证并向AC注册，然后下载固件并与AC建立控制通道。之后，WTP和AC之间可以进行控制和配置的消息交换。下表概述了WTP和AC之间通常按照其典型顺序执行的基本操作：
1. Discovery: The WTPs discover the AC with which they will be bound to and controlled by. The discovery procedure can employ either static or dynamic configuration. In the latter case, a protocol is used in order for the WTP to discover candidate AC(s).
1. 发现：WTP发现将与其绑定和控制的AC。发现过程可以采用静态或动态配置。在后一种情况下，使用协议以便WTP发现候选AC。
2. Authentication: After discovery, the WTP device authenticates itself with the AC. However, mutual authentication, in which the WTP also authenticates the AC, is not always supported since some vendors strive for zero-configuration on the WTP side. This is not necessarily secure as it leaves the possible vulnerability of the WTP being attached to a rogue AC.
2. 身份验证：发现后，WTP设备使用AC对自身进行身份验证。但是，由于一些供应商力求在WTP端实现零配置，因此并不总是支持WTP也对AC进行身份验证的相互身份验证。这不一定是安全的，因为它会使WTP的可能漏洞连接到恶意AC。
3. WTP Association: After successful authentication, a WTP registers with the AC in order to start receiving management and configuration messages.
3. WTP关联：成功身份验证后，WTP向AC注册，以便开始接收管理和配置消息。
4. Firmware Download: After successful association, the WTP may pull, or the AC may push, the WTPs firmware, which may be protected in some manner, such as digital signatures.
4. 固件下载：成功关联后，WTP可能会拉取或推送WTPs固件，这些固件可能会以某种方式受到保护，如数字签名。
5. Control Channel Establishment: The WTP establishes either an IP-tunnel or performs Ethernet encapsulation with the AC in order to transfer data traffic and management frames.
5. 控制通道建立：WTP建立IP隧道或与AC进行以太网封装，以传输数据流量和管理帧。
6. Configuration Download: Following the control channel establishment process, the AC may push configuration parameters to the WTPs.
6. 配置下载：在控制信道建立过程之后，AC可将配置参数推送到WTP。
Given the varied distribution of functionalities for the Centralized Architecture, as surveyed in Section 4.3, it is obvious that an extra network binding is created between the WTP and the AC. This brings new and unique security issues and subsequent requirements.
鉴于集中式体系结构的功能分布不同，如第4.3节所述，很明显，WTP和AC之间创建了额外的网络绑定。这带来了新的独特安全问题和后续需求。
The survey shows clearly that the termination point for "over the air" 802.11 encryption [4] can be implemented either in the WTP or in the AC. Furthermore, the 802.1X/EAP [6] functionality is distributed between the WTP and the AC where, in most cases, the AC performs the necessary functions as the authenticator in the 802.1X exchange.
调查清楚地表明，“空中”802.11加密[4]的终止点可以在WTP或AC中实现。此外，802.1X/EAP[6]功能分布在WTP和AC之间，在大多数情况下，AC作为802.1X交换中的身份验证程序执行必要的功能。
If the STA and AC are the parties in the 4-way handshake (defined in [4]), and 802.11i traffic encryption terminates at the WTP, then the Pairwise Transient Key (PTK) has to be transferred from the AC to the WTP. Since the keying material is part of the control and provisioning of the WTPs, a secure encrypted tunnel for control frames is employed to transport the keying material.
如果STA和AC是4路握手（定义见[4]）中的双方，并且802.11i流量加密在WTP终止，则必须将成对瞬态密钥（PTK）从AC传输到WTP。由于密钥材料是WTP控制和供应的一部分，因此使用用于控制帧的安全加密隧道来传输密钥材料。
The centralized model encourages AC implementations to use one PMK for many different WTPs. This practice facilitates speedy transition by an STA from one WTP to another that is connected to the same AC without establishing a separate PMK. However, this leaves the STA in a difficult position, as the STA cannot distinguish between a compromised PMK and one that is intentionally being shared. This issue must be resolved, but the resolution is beyond the scope of the CAPWAP working group. The venue for this resolution is to be determined by the IEEE 802 and IETF liaisons.
集中式模型鼓励AC实现对多个不同的WTP使用一个PMK。这种做法有助于STA从一个WTP快速过渡到连接到同一AC的另一个WTP，而无需建立单独的PMK。然而，这使得STA处于困难的位置，因为STA无法区分受损PMK和有意共享的PMK。这个问题必须得到解决，但该决议超出了CAPWAP工作组的范围。本决议的地点由IEEE 802和IETF联络人确定。
When the 802.11i encryption/decryption is performed in the AC, the key exchange and state transitions occur between the AC and the STA. Therefore, there is no need to transfer any crypto material between the AC and the WTP.
当在AC中执行802.11i加密/解密时，在AC和STA之间发生密钥交换和状态转换。因此，无需在AC和WTP之间传输任何加密材料。
Regardless of where the 802.11i termination point occurs, the Centralized WLAN Architecture records two practices for "over the wire" client data security. In some cases there is an encrypted tunnel (IPsec or SSL) between the WTP and AC, which assumes that the security boundary is in the AC. In other cases, an end-to-end mutually authenticated secure VPN tunnel is assumed between the client and AC, other security gateway, or end host entity.
无论802.11i终止点出现在何处，集中式WLAN体系结构都会记录“在线”客户端数据安全的两种实践。在某些情况下，WTP和AC之间存在一个加密隧道（IPsec或SSL），该隧道假定安全边界在AC中。在其他情况下，客户端和AC、其他安全网关或终端主机实体之间存在端到端相互验证的安全VPN隧道。
In order for the CAPWAP functions to be implemented in the Centralized WLAN Architecture, a control channel is necessary between the WTP and AC.
为了在集中式WLAN架构中实现CAPWAP功能，WTP和AC之间需要一个控制通道。
To address potential security threats against the control channel, existing implementations feature one or more of the following security mechanisms:
为了解决控制通道面临的潜在安全威胁，现有实现具有以下一个或多个安全机制：
1. Secure discovery of WTP and AC.
1. WTP和AC的安全发现。
2. Authentication of the WTPs to the ACs (and possibly mutual authentication).
2. WTP到ACs的身份验证（以及可能的相互身份验证）。
3. Confidentiality, integrity, and replay protection of control channel frames.
3. 控制通道帧的机密性、完整性和重播保护。
4. Secure management of WTPs and ACs, including mechanisms for securely setting and resetting secrets and state.
4. WTP和ACs的安全管理，包括安全设置和重置机密和状态的机制。
Discovery and authentication of WTPs are addressed in the submissions by implementing authentication mechanisms that range from X.509 certificates, AAA authentication to pre-shared credential authentication. In all cases, confidentiality, integrity, and protection against man-in-the-middle attacks of the control frames are addressed by a secure encrypted tunnel between the WTP and AC(s), utilizing keys derived from the authentication methods mentioned previously. Finally, one of the motivations for the Centralized WLAN Architecture is to minimize the storage of cryptographic and security sensitive information, in addition to operational configuration parameters within the WTPs. It is for that reason that the majority of the submissions under the Centralized Architecture category have employed a post WTP authenticated discovery phase of configuration provisioning, which in turn protects against the theft of WTPs.
WTP的发现和身份验证在提交文件中通过实现从X.509证书、AAA身份验证到预共享凭证身份验证的身份验证机制来解决。在所有情况下，机密性、完整性和针对控制帧的中间人攻击的保护通过WTP和AC（s）之间的安全加密隧道来解决，该隧道利用从前面提到的认证方法派生的密钥。最后，集中式WLAN体系结构的一个动机是，除了WTP内的操作配置参数外，最大限度地减少加密和安全敏感信息的存储。正是由于这个原因，集中式体系结构类别下的大多数提交都采用了配置供应的WTP认证后发现阶段，这反过来又可以防止WTP被盗。
To provide comprehensive radio coverage, WTPs are often installed in locations that are difficult to secure physically; it is relatively easier to secure the AC physically. If high-value secrets, such as a RADIUS shared secret, are stored in the AC instead of WTPs, then the physical loss of an WTP does not compromise these secrets. Hence, the Centralized Architecture may reduce the security consequences of a stolen WTP. On the other hand, concentrating all the high-value secrets in one place makes the AC an attractive target that requires strict physical, procedural, and technical controls to protect the secrets.
为了提供全面的无线电覆盖，WTP通常安装在物理上难以安全的位置；相对而言，从物理上固定空调比较容易。如果高值机密（例如RADIUS共享机密）存储在AC而不是WTP中，则WTP的物理丢失不会损害这些机密。因此，集中式体系结构可以减少被盗WTP的安全后果。另一方面，将所有高价值机密集中在一个地方使AC成为一个有吸引力的目标，需要严格的物理、程序和技术控制来保护机密。
Out of the sixteen architecture survey submissions, three belong to the Distributed Mesh Architecture family. An example of the Distributed Mesh Architecture is shown in Figure 13, and reflects some of the common characteristics found in these three submissions.
在16份架构调查报告中，有3份属于分布式网格架构家族。分布式网格体系结构的一个示例如图13所示，反映了这三份提交文件中的一些共同特征。
+-----------------+ +-----------------+
| 802.11 BSS 1 | | 802.11 BSS 2 |
| ... | | ... |
| +---------+ | | +---------+ |
+----|mesh node|--+ +----|mesh node|--+
+-+---+---+ +-+-+-----+
| | | |
| | | | +----------+
| +-----------------------+ | Ethernet | Ethernet |
| 802.11 wireless links | +--------+ Switch |
| +-----------------------+ | | | |
| | | | | +----------+
+-+---+---+ +-+--+----+
+----|mesh node|--+ +----|mesh node|--+
| +---------+ | | +---------+ |
| ... | | ... |
| 802.11 BSS 4 | | 802.11 BSS 3 |
+-----------------+ +-----------------+
+-----------------+ +-----------------+
| 802.11 BSS 1 | | 802.11 BSS 2 |
| ... | | ... |
| +---------+ | | +---------+ |
+----|mesh node|--+ +----|mesh node|--+
+-+---+---+ +-+-+-----+
| | | |
| | | | +----------+
| +-----------------------+ | Ethernet | Ethernet |
| 802.11 wireless links | +--------+ Switch |
| +-----------------------+ | | | |
| | | | | +----------+
+-+---+---+ +-+--+----+
+----|mesh node|--+ +----|mesh node|--+
| +---------+ | | +---------+ |
| ... | | ... |
| 802.11 BSS 4 | | 802.11 BSS 3 |
+-----------------+ +-----------------+
Figure 13: Example of Distributed Mesh Architecture
图13：分布式网格体系结构示例
To provide wider wireless coverage, mesh nodes in the network may act as APs to client stations in their respective BSS, as well as traffic relays to neighboring mesh nodes via 802.11 wireless links. It is also possible that some mesh nodes in the network may serve only as wireless traffic relays for other mesh nodes, but not as APs for any client stations. Instead of pulling Ethernet cable connections to every AP, wireless mesh networks provide an attractive alternative to relaying backhaul traffic.
为了提供更广泛的无线覆盖，网络中的mesh节点可以充当到其各自BSS中的客户端站的ap，以及经由802.11无线链路到相邻mesh节点的业务中继。网络中的一些mesh节点也可能仅用作其他mesh节点的无线业务中继，而不用作任何客户端站的ap。无线网状网络不再将以太网电缆连接到每个AP，而是为中继回程流量提供了一个有吸引力的替代方案。
Mesh nodes can also keep track of the state of their neighboring nodes, or even nodes beyond their immediate neighborhood by exchanging information periodically amongst them; this way, mesh nodes can be fully aware of the dynamic network topology and RF conditions around them. Such peer-to-peer communication model allows mesh nodes to actively coordinate among themselves to achieve self-configuration and self-healing. This is the major distinction between this Distributed Architecture family and the Centralized Architecture -- much of the CAPWAP functions can be implemented
网格节点还可以通过在它们之间周期性地交换信息来跟踪其相邻节点的状态，甚至跟踪其直接邻域之外的节点的状态；这样，mesh节点可以完全了解动态网络拓扑和周围的射频条件。这种点对点通信模型允许mesh节点之间进行主动协调，以实现自我配置和自我修复。这是分布式体系结构系列和集中式体系结构之间的主要区别——大部分CAPWAP功能都可以实现
across the mesh nodes in a distributed fashion, without a centralized entity making all the control decisions.
以分布式方式跨越网格节点，无需集中实体做出所有控制决策。
It is worthwhile to point out that mesh networks do not necessarily preclude the use of centralized control. It is possible that a combination of centralized and distributed control co-exists in mesh networks. Some global configuration or policy change may be better served in a coordinated fashion if some form of Access Controller (AC) exists in the mesh network (even if not the full blown version of the AC, as defined in the Centralized WLAN Architecture). For example, a centralized management entity can be used to update every mesh node's default configuration. It may also be more desirable to leave certain functions, such as user authentication to a single centralized end point (such as a RADIUS server), but mesh networks allow each mesh AP to directly talk to the RADIUS server. This eliminates the single point of failure and takes advantage of the client distribution in the network.
值得指出的是，网状网络并不一定排除使用集中控制。网状网络中可能同时存在集中控制和分布式控制的组合。如果网状网络中存在某种形式的接入控制器（AC）（即使不是集中式WLAN架构中定义的AC的完整版本），则可以以协调的方式更好地服务于某些全局配置或策略更改。例如，可以使用集中式管理实体更新每个网格节点的默认配置。将某些功能（如用户身份验证）留给单个集中的端点（如RADIUS服务器）也可能更为理想，但网状网络允许每个网状AP直接与RADIUS服务器通信。这消除了单点故障，并利用了网络中的客户端分布。
The backhaul transport network of the mesh network can be either an L2 or L3 networking technology. Currently, vendors are using proprietary mesh technologies on top of standard 802.11 wireless links to enable peer-to-peer communication between the mesh nodes. Hence, there is no interoperability among mesh nodes from different vendors. The IEEE 802.11 WG has recently started a new Task Group (TGs) to define the mesh standard for 802.11.
网状网络的回程传输网络可以是L2或L3网络技术。目前，供应商正在标准802.11无线链路之上使用专有的mesh技术，以实现mesh节点之间的对等通信。因此，不同供应商的网格节点之间不存在互操作性。IEEE 802.11工作组最近启动了一个新的任务组（TGs），以定义802.11的网格标准。
Similar security concerns for client data security, as described in Section 5.8.1, also apply to the Distributed Mesh Architecture. Additionally, one important security consideration for the mesh networks is that the mesh nodes must authenticate each other within the same administrative domain. To protect user and management data that may not be secured at layer 3, data transmission among neighboring nodes should be secured by a layer 2 mechanism of confidentiality, integrity, and replay protection.
如第5.8.1节所述，客户机数据安全的类似安全问题也适用于分布式网格体系结构。此外，mesh网络的一个重要安全考虑因素是mesh节点必须在同一管理域内相互认证。为了保护第3层可能不安全的用户和管理数据，相邻节点之间的数据传输应通过第2层保密、完整和重播保护机制进行保护。
We requested existing WLAN vendors and other interested parties to submit a short description of existing or desired WLAN access network architectures to define a taxonomy of possible WLAN access network architectures. The information from the 16 submissions was condensed and summarized in this document.
我们要求现有的WLAN供应商和其他相关方提交现有或期望的WLAN接入网络架构的简短描述，以定义可能的WLAN接入网络架构的分类。本文件对16份提交文件中的信息进行了浓缩和总结。
New terminology has been defined wherever existing terminology was found to be either insufficient or ambiguous in describing the WLAN architectures and supporting functions listed in the document. For
如果发现现有术语在描述文档中列出的WLAN架构和支持功能时不够充分或不明确，则定义了新术语。对于
example, the broad set of Access Point functions has been divided into two categories: 802.11 functions, which include those that are required by the IEEE 802.11 standards, and CAPWAP functions, which include those that are not required by the IEEE 802.11, but are deemed essential for control, configuration, and management of 802.11 WLAN access networks. Another term that has caused considerable ambiguity is "Access Point", which usually reflected a physical box that has the antennas, but did not have a uniform set of externally consistent behavior across submissions. To remove this ambiguity, we have redefined the AP as the set of 802.11 and CAPWAP functions, while the physical box that terminates the 802.11 PHY is called the Wireless Termination Point.
例如，广泛的接入点功能集被分为两类：802.11功能，其中包括IEEE 802.11标准要求的功能；CAPWAP功能，其中包括IEEE 802.11不要求的功能，但被视为控制、配置和维护所必需的功能，802.11无线局域网接入网络的管理。另一个引起相当多歧义的术语是“接入点”，它通常反映了一个具有天线的物理盒，但在提交文件中没有一组统一的外部一致性行为。为了消除这种模糊性，我们将AP重新定义为802.11和CAPWAP功能集，而终止802.11 PHY的物理框称为无线终止点。
Based on the submissions during the architecture survey phase, we have classified the existing WLAN architectures into three broad classes:
根据架构调查阶段提交的材料，我们将现有WLAN架构分为三大类：
1. Autonomous WLAN Architecture: Indicates a family of architectures in which all the 802.11 functions and, where applicable, CAPWAP functions are implemented in the WTPs.
1. 自主WLAN体系结构：表示在WTP中实现所有802.11功能和CAPWAP功能（如适用）的一系列体系结构。
2. Centralized WLAN Architecture: Indicates a family of architectures in which the AP functions are split between the WTPs and the AC, with the AC acting as a centralized control point for multiple WTPs.
2. 集中式WLAN体系结构：表示一系列体系结构，其中AP功能在WTP和AC之间划分，AC充当多个WTP的集中控制点。
3. Distributed WLAN Architecture: Indicates a family of architectures in which part of the control functions is implemented across a distributed network of peer entities.
3. 分布式WLAN体系结构：表示一系列体系结构，其中部分控制功能通过对等实体的分布式网络实现。
Within the Centralized WLAN Architecture, there are a few visible sub-categories that depend on how one maps the MAC functions (at a high-level), between the WTP and the AC. Three prominent sub-categories emerged from the information in the submissions:
在集中式WLAN体系结构中，有几个可见的子类别，取决于如何在WTP和AC之间映射MAC功能（在高层）。从提交的信息中可以看出三个突出的子类别：
1. Split MAC Architecture: The 802.11 MAC functions are split between the WTP and the AC. This subgroup includes all architectures that split the 802.11 MAC functions even though individual submissions differed on the specifics of the split.
1. 拆分MAC体系结构：802.11 MAC功能在WTP和AC之间拆分。此子组包括拆分802.11 MAC功能的所有体系结构，即使个别提交的内容在拆分的细节上有所不同。
2. Local MAC Architecture: The entire set of 802.11 MAC functions is implemented on the WTP.
2. 本地MAC架构：整个802.11 MAC功能集在WTP上实现。
3. Remote MAC Architecture: The entire set of 802.11 MAC functions is implemented on the AC.
3. 远程MAC架构：整个802.11 MAC功能集在AC上实现。
The following tree diagram summarizes the architectures documented in this taxonomy.
下面的树形图总结了此分类法中记录的体系结构。
+----------------+
|Autonomous |
+---------->|Architecture |
| |Family |
| +----------------+
| +--------------+
| |Local |
| +---->|MAC |
| | |Architecture |
| | +--------------+
| |
| +----------------+ | +--------------+
| |Centralized | | |Split |
+---------->|Architecture |--+---->|MAC |
| |Family | | |Architecture |
| +----------------+ | +--------------+
| |
| | +--------------+
| | |Remote |
| +---->|MAC |
| |Architecture |
| +--------------+
| +----------------+
| |Distributed Mesh|
+---------->|Architecture |
|Family |
+----------------+
+----------------+
|Autonomous |
+---------->|Architecture |
| |Family |
| +----------------+
| +--------------+
| |Local |
| +---->|MAC |
| | |Architecture |
| | +--------------+
| |
| +----------------+ | +--------------+
| |Centralized | | |Split |
+---------->|Architecture |--+---->|MAC |
| |Family | | |Architecture |
| +----------------+ | +--------------+
| |
| | +--------------+
| | |Remote |
| +---->|MAC |
| |Architecture |
| +--------------+
| +----------------+
| |Distributed Mesh|
+---------->|Architecture |
|Family |
+----------------+
A majority of the submitted WLAN access network architectures (twelve out of sixteen) followed the Centralized WLAN Architecture. All but one of the Centralized WLAN Architecture submissions were grouped into either a Split MAC Architecture or a Local MAC Architecture. One submission followed the Autonomous WLAN Architecture, and three followed the Distributed WLAN Architecture.
大多数提交的WLAN接入网络架构（16个架构中的12个）遵循集中式WLAN架构。除了一个集中式WLAN体系结构提交之外，所有提交的WLAN体系结构都分为拆分MAC体系结构或本地MAC体系结构。一份提交遵循自主WLAN架构，三份提交遵循分布式WLAN架构。
The WLAN access network architectures in the submissions indicated that the connectivity assumptions were:
提交文件中的WLAN接入网络架构表明，连接假设为：
o Direct connection between the WTP and the AC.
o WTP和AC之间的直接连接。
o L2 switched connection between the WTP and the AC.
o WTP和AC之间的L2交换连接。
o L3 routed connection between the WTP and the AC.
o WTP和AC之间的L3路由连接。
o Wireless connection between the mesh nodes in the distributed mesh architecture.
o 分布式网格体系结构中网格节点之间的无线连接。
Interoperability between equipment from different vendors is one of the fundamental problems in the WLAN market today. To achieve interoperability via open standard development, the following steps are suggested for IETF and IEEE 802.11.
来自不同供应商的设备之间的互操作性是当今WLAN市场的基本问题之一。为了通过开放标准开发实现互操作性，建议IETF和IEEE 802.11采用以下步骤。
Using this taxonomy, a functional model of an Access Point should be defined by the new study group recently formed within the IEEE 802.11. The functional model will consist of defining functional elements of an 802.11 Access Point that are considered atomic, i.e., not subject to further splitting across multiple network elements. Such a functional model should serve as a common foundation to support the existing WLAN architectures as outlined in this taxonomy, and any further architecture development within or outside the IEEE 802.11 group. It is possible, and even recommended, that work on the functional model definition may also include impact analysis of implementing each functional element on either the WTP or the AC.
使用这种分类法，接入点的功能模型应由最近在IEEE 802.11中成立的新研究小组定义。功能模型将包括定义被认为是原子的802.11接入点的功能元素，即，不受多个网络元素进一步分割的影响。这样的功能模型应该作为一个共同的基础来支持现有的WLAN体系结构，如该分类中所概述的，以及IEEE 802.11组内部或外部的任何进一步的体系结构开发。功能模型定义的工作也可能包括对在WTP或AC上实施每个功能要素的影响分析，这是可能的，甚至是建议的。
As part of the functional model definition, interfaces must be defined as primitives between these functional elements. If a pair of functional elements that have an interface defined between them is being implemented on two different network entities, then a protocol specification definition between such a pair of network elements is required, and should be developed by the IETF.
作为功能模型定义的一部分，接口必须定义为这些功能元素之间的原语。如果在两个不同的网络实体上实现了一对定义了接口的功能元件，则需要在这对网络元件之间定义协议规范，并应由IETF制定。
This document does not intend to provide a comprehensive threat analysis of all of the security issues with the different WLAN architectures. Nevertheless, in addition to documenting the architectures employed in the existing IEEE 802.11 products in the market, this taxonomy document also catalogues the security issues that arise and the manner in which vendors address these security threats. The WLAN architectures are broadly categorized into three families: Autonomous Architecture, Centralized Architecture, and Distributed Architecture. While Sections 4, 5, and 6 are devoted to each of these three architecture families, respectively, each section also contains a subsection to address the security issues within each architecture family.
本文档不打算对不同WLAN架构的所有安全问题进行全面的威胁分析。然而，除了记录市场上现有IEEE 802.11产品中采用的体系结构外，本分类法文件还对出现的安全问题以及供应商解决这些安全威胁的方式进行了分类。WLAN体系结构大致分为三大类：自治体系结构、集中式体系结构和分布式体系结构。虽然第4节、第5节和第6节分别介绍了这三个体系结构系列中的每一个，但每一节还包含一个小节来解决每个体系结构系列中的安全问题。
In summary, the main security concern in the Autonomous Architecture is the mutual authentication between the WTP and the wired (Ethernet) infrastructure equipment. Physical security of the WTPs is also a network security concern because the WTPs contain secret information and theft of these devices could potentially compromise even the wired network.
总之，自治架构中的主要安全问题是WTP和有线（以太网）基础设施设备之间的相互认证。WTP的物理安全也是一个网络安全问题，因为WTP包含机密信息，这些设备的盗窃甚至可能危及有线网络。
In the Centralized Architecture there are a few new security concerns due to the new network binding between the WTP and AC. The following security concerns are raised for this architecture family: keying material for mobile client traffic may need to be securely transported from the AC to WTP; secure discovery of the WTP and AC is required, as well as mutual authentication between the WTPs and AC; man-in-the-middle attacks to the control channel between WTP and AC, confidentiality, integrity and replay protection of control channel frames, and theft of WTPs for extraction of embedded secrets within. Each of the survey results for this broad architecture category has presented mechanisms to address these security issues.
在集中式体系结构中，由于WTP和AC之间的新网络绑定，存在一些新的安全问题。针对该体系结构系列提出了以下安全问题：移动客户端流量的密钥材料可能需要从AC安全地传输到WTP；需要WTP和AC的安全发现，以及WTP和AC之间的相互认证；中间人攻击WTP和AC之间的控制通道，控制通道帧的机密性、完整性和重放保护，以及窃取WTP以提取其中的嵌入式机密。这一广泛体系结构类别的每个调查结果都提出了解决这些安全问题的机制。
The new security issue in the Distributed Mesh Architecture is the need for mesh nodes to authenticate each other before forming a secure mesh network. Encrypted communication between mesh nodes is recommended to protect both control and user data.
分布式Mesh体系结构中的新安全问题是，在形成安全Mesh网络之前，Mesh节点需要相互验证。建议在mesh节点之间进行加密通信，以保护控制和用户数据。
This taxonomy is truly a collaborative effort with contributions from a large group of people. First, we want to thank all the CAPWAP Architecture Design Team members who have spent many hours in the teleconference calls, over e-mails, and in writing and reviewing the document. The full Design Team is listed here:
这种分类法是一种真正的协作，由一大群人共同贡献。首先，我们要感谢所有CAPWAP体系结构设计团队成员，他们花了很多时间在电话会议、电子邮件、写作和审阅文档中。此处列出了完整的设计团队：
o Peyush Agarwal STMicroelectronics Plot# 18, Sector 16A Noida, U.P 201301 India Phone: +91-120-2512021 EMail: peyush.agarwal@st.com
o Peyush Agarwal意法半导体地块18号，U.P.诺伊达16A区201301印度电话：+91-120-2512021电子邮件：Peyush。agarwal@st.com
o Dave Hetherington Roving Planet 4750 Walnut St., Suite 106 Boulder, CO 80027 United States Phone: +1-303-996-7560 EMail: Dave.Hetherington@RovingPlanet.com
o Dave Hetherington Roving Planet美国科罗拉多州博尔德胡桃街4750号106室电话：+1-303-996-7560电子邮件：Dave。Hetherington@RovingPlanet.com
o Matt Holdrege Strix Systems 26610 Agoura Road Calabasas, CA 91302 Phone: +1 818-251-1058 EMail: matt@strixsystems.com
o Matt Holdrege Strix Systems 26610 Agoura Road Calabasas，CA 91302电话：+1 818-251-1058电子邮件：matt@strixsystems.com
o Victor Lin Extreme Networks 3585 Monroe Street Santa Clara, CA 95051 Phone: +1 408-579-3383 EMail: vlin@extremenetworks.com
o Victor Lin Extreme Networks加利福尼亚州圣克拉拉梦露街3585号95051电话：+1 408-579-3383电子邮件：vlin@extremenetworks.com
o James M. Murphy Trapeze Networks 5753 W. Las Positas Blvd. Pleasanton, CA 94588 Phone: +1 925-474-2233 EMail: jmurphy@trapezenetworks.com
o 詹姆斯M.墨菲吊架网络5753西拉斯波西塔斯大道。加利福尼亚州普莱森顿94588电话：+1925-474-2233电子邮件：jmurphy@trapezenetworks.com
o Partha Narasimhan Aruba Wireless Networks 180 Great Oaks Blvd San Jose, CA 95119 Phone: +1 408-754-3018 EMail: partha@arubanetworks.com
o Partha Narasimhan Aruba无线网络180 Great Oaks Blvd San Jose，CA 95119电话：+1 408-754-3018电子邮件：partha@arubanetworks.com
o Bob O'Hara Airespace 110 Nortech Parkway San Jose, CA 95134 Phone: +1 408-635-2025 EMail: bob@airespace.com
o Bob O'Hara Airespace 110 Nortech Parkway San Jose，CA 95134电话：+1 408-635-2025电子邮件：bob@airespace.com
o Emek Sadot (see Authors' Addresses)
o Emek Sadot（见作者地址）
o Ajit Sanzgiri Cisco Systems 170 W Tasman Drive San Jose, CA 95134 Phone: +1 408-527-4252 EMail: sanzgiri@cisco.com
o Ajit Sanzgiri Cisco Systems 170 W加利福尼亚州圣何塞塔斯曼大道95134电话：+1 408-527-4252电子邮件：sanzgiri@cisco.com
o Singh Chantry Networks 1900 Minnesota Court Mississauga, Ontario L5N 3C9 Canada Phone: +1 905-567-6900 EMail: isingh@chantrynetworks.com
o Singh Chantry Networks 1900明尼苏达法院安大略省密西沙加L5N 3C9加拿大电话：+1 905-567-6900电子邮件：isingh@chantrynetworks.com
o L. Lily Yang (Editor, see Authors' Addresses)
o 杨丽丽（编辑，见作者地址）
o Petros Zerfos (see Authors' Addresses)
o Petros Zerfos（见作者地址）
In addition, we would also like to acknowledge contributions from the following individuals who participated in the architecture survey and provided detailed input data in preparation of the taxonomy: Parviz Yegani, Cheng Hong, Saravanan Govindan, Bob Beach, Dennis Volpano, Shankar Narayanaswamy, Simon Barber, Srinivasa Rao Addepalli, Subhashini A. Venkataramanan, Kue Wong, Kevin Dick, Ted Kuo, and Tyan-shu Jou. It is simply impossible to write this taxonomy without the large set of representative data points that they provided to us. We would also like to thank our CAPWAP WG co-chairs, Mahalingam Mani and Dorothy Gellert, and our Area Director, Bert Wijnen, for their unfailing support.
此外，我们还要感谢以下个人的贡献，他们参与了建筑调查，并为分类法的编制提供了详细的输入数据：Parviz Yegani、Cheng Hong、Saravanan Govindan、Bob Beach、Dennis Volpano、Shankar Narayanaswamy、Simon Barber、Srinivasa Rao Addepalli、，Subhashini A.Venkataramanan、Kue Wong、Kevin Dick、Ted Kuo和Tyan shu Jou。如果没有他们提供给我们的大量代表性数据点，编写这种分类法是不可能的。我们还要感谢我们的CAPWAP工作组联合主席Mahalingam Mani和Dorothy Gellert，以及我们的区域总监Bert Wijnen，感谢他们始终如一的支持。
[1] "IEEE WLAN MAC and PHY Layer Specifications", August 1999, <IEEE 802.11-99>.
[1] “IEEE WLAN MAC和PHY层规范”，1999年8月，<IEEE 802.11-99>。
[2] O'Hara, B., Calhoun, P., and J. Kempf, "Configuration and Provisioning for Wireless Access Points (CAPWAP) Problem Statement", RFC 3990, February 2005.
[2] O'Hara，B.，Calhoun，P.，和J.Kempf，“无线接入点（CAPWAP）的配置和供应问题声明”，RFC 39902005年2月。
[3] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[3] Bradner，S.，“RFC中用于表示需求水平的关键词”，BCP 14，RFC 2119，1997年3月。
[4] "IEEE Std 802.11i: Medium Access Control (MAC) Security Enhancements", April 2004.
[4] “IEEE标准802.11i：媒体访问控制（MAC）安全增强”，2004年4月。
[5] "IEEE Std 802.11h: Spectrum and Transmit Power Management Extensions in the 5 GHz Band in Europe", October 2003.
[5] “IEEE标准802.11h：欧洲5 GHz频段的频谱和发射功率管理扩展”，2003年10月。
[6] "IEEE Std 802.1X: Port-based Network Access Control", June 2001.
[6] “IEEE标准802.1X：基于端口的网络访问控制”，2001年6月。
Authors' Addresses
作者地址
L. Lily Yang Intel Corp. MS JF3 206, 2111 NE 25th Avenue Hillsboro, OR 97124
L.Lily Yang Intel Corp.JF3 206女士，希尔斯博罗东北25大道2111号，邮编：97124
Phone: +1 503-264-8813
EMail: lily.l.yang@intel.com
Phone: +1 503-264-8813
EMail: lily.l.yang@intel.com
Petros Zerfos UCLA - Computer Science Department 4403 Boelter Hall Los Angeles, CA 90095
加州大学洛杉矶分校Petros Zerfos计算机科学系4403 Boelter Hall洛杉矶，加利福尼亚90095
Phone: +1 310-206-3091
EMail: pzerfos@cs.ucla.edu
Phone: +1 310-206-3091
EMail: pzerfos@cs.ucla.edu
Emek Sadot Avaya Atidim Technology Park, Building #3 Tel-Aviv 61131 Israel
以色列特拉维夫3号楼Emek Sadot Avaya Atidim科技园61131
Phone: +972-3-645-7591
EMail: esadot@avaya.com
Phone: +972-3-645-7591
EMail: esadot@avaya.com
Full Copyright Statement
完整版权声明
Copyright (C) The Internet Society (2005).
版权所有（C）互联网协会（2005年）。
This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.
本文件受BCP 78中包含的权利、许可和限制的约束，除其中规定外，作者保留其所有权利。
This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
本文件及其包含的信息是按“原样”提供的，贡献者、他/她所代表或赞助的组织（如有）、互联网协会和互联网工程任务组不承担任何明示或暗示的担保，包括但不限于任何保证，即使用本文中的信息不会侵犯任何权利，或对适销性或特定用途适用性的任何默示保证。
Intellectual Property
知识产权
The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79.
IETF对可能声称与本文件所述技术的实施或使用有关的任何知识产权或其他权利的有效性或范围，或此类权利下的任何许可可能或可能不可用的程度，不采取任何立场；它也不表示它已作出任何独立努力来确定任何此类权利。有关RFC文件中权利的程序信息，请参见BCP 78和BCP 79。
Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr.
向IETF秘书处披露的知识产权副本和任何许可证保证，或本规范实施者或用户试图获得使用此类专有权利的一般许可证或许可的结果，可从IETF在线知识产权存储库获取，网址为http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org.
IETF邀请任何相关方提请其注意任何版权、专利或专利申请，或其他可能涵盖实施本标准所需技术的专有权利。请将信息发送至IETF的IETF-ipr@ietf.org.
Acknowledgement
确认
Funding for the RFC Editor function is currently provided by the Internet Society.
RFC编辑功能的资金目前由互联网协会提供。