Re: ESSID ietf-v6only at IETF 100

[Warren Kumari <[e-mail]>]

On Tue, Nov 14, 2017 at 2:03 PM, Alexandre Petrescu <
[e-mail]> wrote:

> Hi,
>
> I have problems connecting to the IPv6-only ESSID "ietf-v6only".
>
> It is a problem of certificates.
>
> I have this problem on Windows since several IETF meetings; it may not be
> related in particular to IPv6.
>
> The message in the window below says: "The server
> services.meeting.ietf.org presented a certifcate valid emitted by
> Starfield CA, but that is not configured as a valid anchor to approve this
> profile".
>
> I dont thave this kind of certification refusal problem on ietf-legacy100
> ESSID (and all earlier ietf-legacy), neither on ietf-nat64-unencrypted.
>

​That's because the legacy (and unencrypted) SSIDs are unencrypted and you
don't need to talk to a RADIUS server (which presents the certificate)



> This ietf-nat64-unencrypted is now appearing first time at IETF.  I
> suppose people realized there was a problem with certs and created an
> 'unencrypted' version.  That's not a best practice to fix security :-)
>


​Nope. We have the legacy SSIDs because some people apparently had issues
connecting to encrypted SSIDs (because of old OS / broken wpa_supplicant,
etc) - this wasn't issue with certs, but rather providing a solution for
those who are unable to do WPA enterprise / have old cards, etc.
 There was an assertion made that some people were not using nat64 and were
using ietf-legacy were easier, and so there should be parity, and so the
ietf-nat64-unencrypted was created.
We are changing the name of the ietf-legacyXXX network at each meeting
because we don't people who connected to it at a previous meeting to become
sticky to it and keep joining -- it requires a specific action at each
meeting for the user to choose the unencrypted network -- we'd all prefer
that people use the encrypted network...





> And yes, my VPN FortiClient works ok on ietf-nat64-unencrypted.
>
>
>
>
> Alex
>
>
>
> --------------------------------------------------------------------
> IETF IPv6 working group mailing list
> [e-mail]
> Administrative Requests: https://www.ietf.org/mailman/listinfo/ipv6
> --------------------------------------------------------------------
>
>


-- 
I don't think the execution is relevant when it was obviously a bad idea in
the first place.
This is like putting rabid weasels in your pants, and later expressing
regret at having chosen those particular rabid weasels and that pair of
pants.
   ---maf