An update on the work of JANET Wireless Advisory Group & The Terena Mobility Taskforce

1. An update on the work of JANET Wireless Advisory Group&The Terena Mobility Taskforce James Sankar UKERNA Internet2 members meeting

2. Contents Page • Background to UKERNA • The Current Network – SuperJANET • The SuperJANET Development Programme & the JANET Network Access Area • JANET Wireless Advisory Group • TF-Mobility update • Internet 2 members collaboration? Internet2 members meeting

3. Current Network - SuperJANET • In service – March 2001 • Backbone – Supplied by WorldCom (now MCI) • Initially 2.5Gbit/s now upgraded to 10 Gbit/s (July 2002) Internet2 members meeting

4. JANET Development Programme “…to underpin the development of SuperJANET, evolving over the coming years to support the applications used by the community, which is served by the network.” Network Access Area • To widen of access to JANET to allow the migration of the learning process from its traditional base in the classroom, lecture theatre and laboratory, to the home and workplace. • To exploit the opening open out of the "local loop" marketplace to enable wider access to JANET. • To develop a broad number of activity areas that can enable the widening of access to the JANET network, such as ADSL, Two-way satellite, Wireless, IP over Power, Cable Modem etc. • To work with other National Research and Education Networks on network access developments Internet2 members meeting

5. Group formed in May 2003. Supported by UKERNA. Initial lifetime of 1 year will be extended in line with the action plan. Group established and consists of Higher education Further education Industry (suppliers and service providers) Website established http://www.ja.net/development/network_access/wireless/wag/wag.htmlwith agenda, minutes and case studies available online. Public mailing list set up “wireless-admin@jiscmail.ac.uk” Terms of reference agreed Action Plan in draft form and under consultation. JANET Wireless Advisory Group Internet2 members meeting

6. JANET Wireless Advisory Group Terms of Reference • Mobile Wireless (40% effort) • Location Independent Networking (30% effort) • Wireless Applications & Services (10% effort) • Point to Point / Multipoint Wireless (20% effort) • Other Activities • One or more end points may change location, such as 802.11, UMTS, GPRS, SMS, Bluetooth) • Where a user can obtain network access independent of their physical location). • Location Based Services & Instant Messaging applications • Both end points have a fixed location, such as Fixed Radio and Infrared Services. • Monitor commercial & community Wireless network activities. • Attend the TF-Mobility meetings. • Monitor standards and legislation. Key aim: To provide advice and guidance to the JANET community on wireless networking Internet2 members meeting

7. What are other Europe NRENs doing? Developing interoperable solutions to existing national solutions as part of the Terena TF mobility group, to develop a Europe wide wireless roaming infrastructure amongst participating NRENs Scaling wireless LAN infrastructures across existing backbones for national “roaming” solutions WLAN Policy & best practice in place Internet2 members meeting

8. Originators of National Roaming solutions across Europe Web-based redirection @ FUNET 802.1X @ SURFnet PPPoE over Linux @ University of Bristol & The University of Swansea VPN @ University of Bremen & SWITCH VPN + Certificates @ FCCN Internet2 members meeting

9. Background • TERENA – Trans European Research and Education Networking Association (brings European NRENs together for European projects) • TF Mobility (Taskforce) officially began on January 1 2003. • The group has an 18 month lifetime. • Aim: ”coordinating research and testing in Europe regarding real usage and scalability of mobility solutions inside the academic community”. • Mobility solutions are defined as • a way to transfer authentication information between organisations so that a user from different organisation may gain wired or wireless access to 1) the visiting organisation’s network or 2) the visitor’s home network for home authentication and network access. • Work Areas • Identify inter-NREN roaming requirements. • Evaluate current national roaming solutions. • Select inter-NREN solution and test. • Evaluate mobile equipment, technology and next generation mobile technology for handover and roaming (mobile IPv4 & v6). Internet2 members meeting

10. Requirements definition Enable NREN users to use Internet (WLAN and wired) everywhere in Europe 1) With minimal administrative overhead (per roaming user) • Very little admin work to enable roaming per user • Minimize the complexity of additional systems required • No n2 work required when scaling system • No regulatory entanglement 2) With good usability • Available to most current WLAN (and wired) users. • No additional software required to enable roaming. • Enable all (work, guest, home networks,IPv4 and IPv6). 3) Maintaining required security for all partners • Allow use only for approved NREN users. • Provide accountability but also confidentiality of traffic. • Guard against data manipulation and session hijacking. • Allow real security (e2e) on top. • Don’t aggravate security issues of visited networks. Internet2 members meeting

11. Cross-domain 802.1X with VLAN assignment (Surfnet) Supplicant Authenticator (AP or switch) RADIUS server Institution A RADIUS server Institution B User DB User DB Guest piet@institution_b.nl Internet signalling Guest VLAN Employee VLAN data Central RADIUS Proxy server Student VLAN Authentication at home institution, 802.1X , TTLS (SecureW2), (proxy) RADIUS. One time passwords are also transmitted via SMS to guest users. A RADIUS Hierarchy is proposed to scale this to a European wide solution. Internet2 members meeting

12. VPN & RADIUS/ PKI Dockingnetwork Dockingnetwork VPN-Gateways VPN-Gateways Campus Network Campus Network G-WiN G-WiN Intranet X Intranet X DHCP, DNS, free Web DHCP, DNS, free Web • Wbone – VPN roaming solution to 4 universities / colleges in state of Bremen. • SWITCHmobile – VPN solution deployed at 7 universities across Switzerland. • A "virtual campus" initiative in Lisbon, and been testing and developing a VPN & PKI infrastructure. Internet2 members meeting

13. AAA Server Access Control Device Internet 4. 3. 5. 1. Docking Network 2. WWW-browser RADIUS based Web interface authentication solution • RADIUS based Web interface authentication at the University of Tampere The Finnish are scaling their solution by using a hierarchy of RADIUS proxy servers for their national infrastructure Internet2 members meeting

14. PPP over Ethernet – University of Bristol nomadic network (with links to the University of Wales) Internet2 members meeting

15. TF-Mobility: Current status • Documentation of national WLAN roaming solutions – complete Characteristics identified as • 802.1X- “The future”, easy to scale, secure but cutting edge, thus expensive. • VPN - Widely available, expensive, secure & hard to scale. • Web based – cheap, widely available, easy to scale, but not secure. • WLAN Product testing matrix – 1st draft completed 3. Preliminary selection for inter-NREN roaming – in draft, conclusions are • No national solution meets all the requirements. • The group has chosen not to consider the following • Local VPN access: VPN users will not be able to access a visited institutions VPN gateway because (though possible) offering access to all VPN servers is not be practical as all participating institutions would have to purchase a VPN server for this single purpose. • PKI: Good to have when ready, currently it is not and would be complex to manage during the group’s limited lifetime. • An architecture that supports the various national solutions is needed, a three stream approach is recommended… Internet2 members meeting

16. Recommendations Define interoperability scenarios for each national solution and identify work needed to integrate these solutions and three development streams together. A phased development / testing approach Subject to feasibility, build the proposed CASG solution • Conduct feasibility tests on creating an scalable VPN solution • Resolve scaling and interoperability issues for 802.1x, VPN, web-based redirect,) Extend to VPN in parallel Build and scale a RADIUS proxy hierarchy for non-VPN AAA • Consolidate findings into a trial report Work on software changes to Roamnode (PPPoE over Linux) to facilitate roaming The testing of inter-NREN roaming solutions has already started ! Internet2 members meeting

17. RADIUS proxy hierarchy established (geographic view) RADIUS Proxy servers connecting to a European level RADIUS proxy server FUNET SURFnet • Participation guidelines are being drafted • Aim is to increase membership. Norway, Slovenia, Czech Republic & Greece have indicated their willingness to join. (DFN) University of Southampton Findings so far (1) A standard is required for username@realm (2) Clear text of authentication details between RADIUS servers can be overcome by using IPSec FCCN CARnet Internet2 members meeting

18. RADIUS proxy hierarchy established (network topology view) Organizational RADIUS Server Organizational RADIUS Server Organizational RADIUS Server Organizational RADIUS Server FOKUS (Berlin) Organizational RADIUS Server Currently linked to FCCN, Portugal Currently linked to CARNET, Croatia Organizational RADIUS Server National RADIUS Proxy Server National RADIUS Proxy Server National RADIUS Proxy Server Top-level RADIUS Proxy Server National RADIUS Proxy Server Organizational RADIUS Server Backup Top-level RADIUS Proxy Server Currently linked to SURFnet, Netherlands Currently hosted at SURFnet Currently linked to FUNET, Finland National RADIUS Proxy Server National RADIUS Proxy Server etlr1.radius.terena.nl (192.87.36.6) etlr2.radius.terena.nl (195.169.131.2) Organizational RADIUS Server Organizational RADIUS Server Organizational RADIUS Server University of Southampton Internet2 members meeting

19. Controlled Address Space for VPN Gateways • Design and work plan documentation underway. • Interoperability tests of VPN to RADIUS proxy hierarchy agreed. • The group is considering using RADIUS for backup. • Further work to follow. Internet2 members meeting

20. Further collaborations??? • The TF-Mobility group welcomes participation within Europe and outside of Europe • Why not join in and participate with us on • The RADIUS Proxy Hierarchy • The Controlled Address Space for VPN Gateways • Contact us, the TF Mobility co-chairs are • James Sankar – j.sankar@ukerna.ac.uk • Carsten Bormann - cabo@tzi.org Further Information JANET Wireless Advisory Group http://www.ja.net/development/network_access/wireless/wag/wag.html JANET Two-way satellite trial http://www.ja.net/development/network_access/satellite/trial.html The Terena Mobility Task Force http://www.terena.nl/tech/task-forces/tf-mobility/ Internet2 members meeting

21. Thank you for your time Any questions ? James Sankar +44 1235 822 223 j.sankar@ukerna.ac.uk Internet2 members meeting