Hi everyone
I am currently preparing to WISECURE exam. Trying to understand everything behind WPA2 Authentication, Key Management, Encryption and Integrity. I think I've got the concept right and have the complete picture already. However, I wanted to confirm my understanding by re-creating few things in a lab and perform few captures.
Everything was ok, until I started to "play" with WLAN session-timeout value. In my understanding, this value tells STAs to go via full dot1x reauth. Also, if I am correct, Cisco has introduced PMK caching in 7.2 or later (don't know exactly) and this timer, in fact, says for how long PMKs have to be stored in WLC's memory.
I have changed this value to 300 seconds (from 1800 default), enabled debug on WLC and started packet capture on WIRE and OTA
WLC shows the following when station connects:
Disable re-auth, use PMK lifetime.
Station 3c:a9:f4:b1:d8:c4 setting dot1x reauth timeout = 300
Setting re-auth timeout to 300 seconds, got from WLAN config.
Station 3c:a9:f4:b1:d8:c4 setting dot1x reauth timeout = 300
Disabling re-auth since PMK lifetime can take care of same.
So, I assume session-timeout was previously responsible for full reauth, but now also tells WLC for how long to keep PMKs in a cache.
In fact, full-reauth is still performed after this timeout, so effectively session-timeout = PMK cache timeout.
Correct me if I am wrong here please?! Anything I need to know about PMK caching and session-timeout (802.1x full reauth)?
I have waited for 20 minutes to collect enough packets for analysis and when I stopped all captures I have noticed the following weird behavior that I don't understand.
Every 5 minutes my WLC generated a series of debug messages that looked very similar to initial authentication (including EAP/RADIUS).
However, I have seen scrambled results in Over the Air capture.
Initial authentication was ok, but all consequent were not shown.
I have found all my EAP packets in the Over-The-Air capture after I removed all EAP/EAPOL filters. Surprisingly, all these frames were encrypted?
Can anyone please confirm that WLC/APs use AES-CCMP to encrypt EAPOL frames when session timeout kicks in and refresh is required?
This is definitely not true when STA is roaming - everything is sent in a clear-text (i.e. EPOL frame structure can be recognized by Wireshark).
In my case Wireshark was unable to decode these packets as EAPOL and binary details were kind of random (i.e. encrypted) for me...
Much appreciate
Tim
P.S. After writing this post... this kind of became rational to me When STA authenticates and encryption is negotiated, everything has to be encrypted, so an EAP performed later will be indeed encrypted. When station ROAMS it has to go via full auth (has no encryption enabled yet) and hence it's clear text... Dumb me. Can anyone please confirm this? And... also session-timeout/PMK cache relationship.
