Handover performance.

[roby]

As you ask! I give  you  some more detail.... 

I need to know if it possible to use pre-authentication using WPA1. I need 
to reduce the handover delay.
DO the pre-authentication work only with RSN/WPA2? 

You can find here my hostapd.conf. It' s same on both APs. 

##### hostapd configuration file #########################################
# Empty lines and lines starting with # are ignored 

# AP netdevice name (without 'ap' prefix, i.e., wlan0 uses wlan0ap for
# management frames)
interface=wlan0 

# hostapd event logger configuration
#
# Two output method: syslog and stdout (only usable if not forking to
# background).
#
# Module bitfield (ORed bitfield of modules that will be logged; -1 = all
# modules):
# bit 0 (1) = IEEE 802.11
# bit 1 (2) = IEEE 802.1X
# bit 2 (4) = RADIUS
# bit 3 (8) = WPA
#
# Levels (minimum value for logged events):
#  0 = verbose debugging
#  1 = debugging
#  2 = informational messages
#  3 = notification
#  4 = warning
#
logger_syslog=-1
logger_syslog_level=2
logger_stdout=-1
logger_stdout_level=2 

# Debugging: 0 = no, 1 = minimal, 2 = verbose, 3 = msg dumps, 4 = excessive
debug=0 

# Dump file for state information (on SIGUSR1)
dump_file=/tmp/hostapd.dump 

# Daemonize hostapd process (i.e., fork to background)
daemonize=1 


##### IEEE 802.11 related configuration 
####################################### 

# SSID to be used in IEEE 802.11 management frames
ssid=accesspoint1 

# Station MAC address -based authentication
# 0 = accept unless in deny list
# 1 = deny unless in accept list
# 2 = use external RADIUS server (accept/deny lists are searched first)
macaddr_acl=0 

# Accept/deny lists are read from separate files (containing list of
# MAC addresses, one per line). Use absolute path name to make sure that the
# files can be read on SIGHUP configuration reloads.
#accept_mac_file=/etc/hostapd.accept
#deny_mac_file=/etc/hostapd.deny 

# IEEE 802.11 specifies two authentication algorithms. hostapd can be
# configured to allow both of these or only one. Open system authentication
# should be used with IEEE 802.1X.
# Bit fields of allowed authentication algorithms:
# bit 0 = Open System Authentication
# bit 1 = Shared Key Authentication (requires WEP)
auth_algs=3 

# Associate as a station to another AP while still acting as an AP on the 
same
# channel.
#assoc_ap_addr=00:12:34:56:78:9a 


##### IEEE 802.1X (and IEEE 802.1aa/D4) related configuration 
################# 

# Require IEEE 802.1X authorization
ieee8021x=1 

# Use internal minimal EAP Authentication Server for testing IEEE 802.1X.
# This should only be used for testing since it authorizes all users that
# suppot IEEE 802.1X without any keys or certificates.
minimal_eap=0 

# Optional displayable message sent with EAP Request-Identity
eap_message=hello 

# WEP rekeying (disabled if key lengths are not set or are set to 0)
# Key lengths for default/broadcast and individual/unicast keys:
# 5 = 40-bit WEP (also known as 64-bit WEP with 40 secret bits)
# 13 = 104-bit WEP (also known as 128-bit WEP with 104 secret bits)
#wep_key_len_broadcast=5
#wep_key_len_unicast=5
# Rekeying period in seconds. 0 = do not rekey (i.e., set keys only once)
#wep_rekey_period=300 

# EAPOL-Key index workaround (set bit7) for WinXP Supplicant (needed only if
# only broadcast keys are used)
eapol_key_index_workaround=1 


##### IEEE 802.11f - Inter-Access Point Protocol (IAPP) 
####################### 

# Interface to be used for IAPP broadcast packets
iapp_interface=access 


##### RADIUS configuration 
####################################################
# for IEEE 802.1X with external Authentication Server, IEEE 802.11
# authentication with external ACL for MAC addresses, and accounting 

# The own IP address of the access point (used as NAS-IP-Address) 

own_ip_addr=192.168.1.2 

# Optional NAS-Identifier string for RADIUS messages. When used, this should 
be
# a unique to the NAS within the scope of the RADIUS server. For example, a
# fully qualified domain name can be used here.
#nas_identifier=ap.example.com 

# RADIUS authentication server
auth_server_addr=192.168.1.1
auth_server_port=1812
auth_server_shared_secret=testing123 

# RADIUS accounting server
acct_server_addr=192.168.1.1
acct_server_port=1813
acct_server_shared_secret=testing123 

# Secondary RADIUS servers; to be used if primary one does not reply to
# RADIUS packets. These are optional and there can be more than one 
secondary
# server listed.
#auth_server_addr=127.0.0.2
#auth_server_port=1812
#auth_server_shared_secret=secret2
#
#acct_server_addr=127.0.0.2
#acct_server_port=1813
#acct_server_shared_secret=secret2 

# Retry interval for trying to return to the primary RADIUS server (in
# seconds). RADIUS client code will automatically try to use the next server
# when the current server is not replying to requests. If this interval is 
set,
# primary server will be retried after configured amount of time even if the
# currently used secondary server is still working.
#radius_retry_primary_interval=600 


# Interim accounting update interval
# If this is set (larger than 0) and acct_server is configured, hostapd will
# send interim accounting updates every N seconds. Note: if set, this 
overrides
# possible Acct-Interim-Interval attribute in Access-Accept message. Thus, 
this
# value should not be configured in hostapd.conf, if RADIUS server is used 
to
# control the interim interval.
# This value should not be less 600 (10 minutes) and must not be less than
# 60 (1 minute).
#radius_acct_interim_interval=600 


##### WPA/IEEE 802.11i configuration ###################################### 

# Enable WPA. Setting this variable configures the AP to require WPA (either
# WPA-PSK or WPA-RADIUS/EAP based on other configuration). For WPA-PSK, 
either
# wpa_psk or wpa_passphrase must be set and wpa_key_mgmt must include 
WPA-PSK.
# For WPA-RADIUS/EAP, ieee8021x must be set (but without dynamic WEP keys),
# RADIUS authentication server must be configured, and WPA-EAP must be 
included
# in wpa_key_mgmt.
# This field is a bit field that can be used to enable WPA (IEEE 
802.11i/D3.0)
# and/or WPA2 (full IEEE 802.11i/RSN):
# bit0 = WPA
# bit1 = IEEE 802.11i/RSN (WPA2)
wpa=1 

# WPA pre-shared keys for WPA-PSK. This can be either entered as a 256-bit
# secret in hex format (64 hex digits), wpa_psk, or as an ASCII passphrase
# (8..63 characters) that will be converted to PSK. This conversion uses 
SSID
# so the PSK changed when ASCII passphrase is used and the SSID is changed.
#wpa_psk=0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef
#wpa_passphrase=secret passphrase 

# Set of accepted key management algorithms (WPA-PSK, WPA-EAP, or both). The
# entries are separated with a space.
wpa_key_mgmt=WPA-EAP 

# Set of accepted cipher suites (encryption algorithms) for pairwise keys
# (unicast packets). This is a space separated list of algorithms:
# CCMP = AES in Counter mode with CBC-MAC [RFC 3610, IEEE 802.11i/D7.0]
# TKIP = Temporal Key Integrity Protocol [IEEE 802.11i/D7.0]
# Group cipher suite (encryption algorithm for broadcast and multicast 
frames)
# is automatically selected based on this configuration. If only CCMP is
# allowed as the pairwise cipher, group cipher will also be CCMP. Otherwise,
# TKIP will be used as the group cipher.
wpa_pairwise=TKIP 

# Time interval for rekeying GTK (broadcast/multicast encryption keys) in
# seconds.
wpa_group_rekey=600 

# Time interval for rekeying GMK (master key used internally to generate 
GTKs
# (in seconds).
wpa_gmk_rekey=86400 

# Enable IEEE 802.11i/RSN/WPA2 pre-authentication. This is used to speed up
# roaming be pre-authenticating IEEE 802.1X/EAP part of the full RSN
# authentication and key handshake before actually associating with a new 
AP.
rsn_preauth=1
#
# Space separated list of interfaces from which pre-authentication frames 
are
# accepted (e.g., 'eth0' or 'eth0 wlan0wds0'. This list should include all
# interface that are used for connections to other APs. This could include
# wired interfaces and WDS links. The normal wireless data interface towards
# associated stations (e.g., wlan0) should not be added, since
# pre-authentication is only used with APs other than the currently 
associated
# one.
rsn_preauth_interfaces=eth0
######################################################################## 

Thanks for your help.
Roby A. 


Denis Vlasenko Scrive: 

> On Wednesday 04 May 2005 13:07, roby wrote:
>> 
>> Hi,  
>> 
>>  I have build a small ESS with 2 access point hostapd based and an access 
>> server with freeradius. The system works with WPA and EAP-TLS 
>> authentication.  
>> 
>> A this time I'm testing the handover delay, for VoIP applications. The 
>> problem is that pre-authentication doesn't seem to work correctly.
>> I made some test, and the delay time is between 4 and 5 seconds. As you can 
>> understand it's a very long delay....
>> I set di Hostapd.conf for support IAPP and also RSN/WPA2 pre-authentication
>> but...  
>> 
>> Can somebody help me to set the pre-authentication? Did anybody make some 
>> similar test? All suggestions are wellcome! 
> 
> I suggest posting more details.
> --
> vda 
>