[Ballot comment]
I know it is redundant, but the security considerations section should re-emphasize the
scope of the threat analysis.

I would suggest something like the following:

OLD:

This document outlines a threat analysis for CAPWAP,

NEW:

This document outlines a threat analysis for CAPWAP in the context of
IEEE 802.11 deployments,

AD review by Dan Romascanu

Please find below the AD Review of draft-ietf-capwap-threat-analysis-01. I believe that the document is mature and stable. I found a small number of issues which are grouped in Technical and Editorial. As none of them has a dramatic impact or would require very consistent editing I suggest to consider these comments as Last Call comments, and proceed directly to IETF Last Call with this document.


T1. Did the editors and the Working Group consider capitalizing RECOMMENDED and NOT RECOMMENDED as per RFC2119 when dealing with the recommended or not recommended practices described in Sections 4.2 and 4.3? If they did I would be interested to hear why they chose not to use capitalization.

T2. Section 8 - I am missing from the list of vulnerabilities introduced by CAPWAP the vulnerabilities introduced by the CAPWAP MIB (or other) management interface. By exposing management objects related to the CAPWAP protocol the management interface exposes information otherwise not accessible to managers of 'fat' APs that a CAPWAP deployment replaces.



E1. [80211I], [80211SEC] and [8021X] are fundamental for the understanding of this document. I suggest that they are moved to Normative References.

E2. It would be appropriate to include a note drawing the attention to the fact that this document is based on the 2004 edition of the IEEE 802.1X standard, and that a new version of the protocol is under development in IEEE 802.1X at the time of the development of this document.

E3. Please be explicit in the Abstract section about the fact that the scope of the document is CAPWAP deployments that will use the IEEE 802.11 binding

SUBMISSION QUESTIONNAIRE FOR:
draft-ietf-capwap-threat-analysis-01
======================================================================

  (1.a)  Who is the Document Shepherd for this document?  Has the
          Document Shepherd personally reviewed this version of the
          document and, in particular, does he or she believe this
          version is ready for forwarding to the IESG for publication?

Mahalingam Mani will be the shepherd for this document.  Yes, I
have fully reviewed the document and believe that it is ready for
publication.

  (1.b)  Has the document had adequate review both from key WG members
          and from key non-WG members?  Does the Document Shepherd have
          any concerns about the depth or breadth of the reviews that
          have been performed?

It is my opinion that this document has been very well-reviewed. The
draft itself is authored by both the Security Advisors to the WG. In
addition to a lot of review within the WG we got an early secdir
review (Joe Salowey) and received considerable ananlysis and feedback
including Security AD as well as IETF chair.  All issues raised during
the course of these reviews were carefully tracked in an issue tracker
and fully addressed.

  (1.c)  Does the Document Shepherd have concerns that the document
          needs more review from a particular or broader perspective,
          e.g., security, operational complexity, someone familiar with
          AAA, internationalization or XML?

No, I believe that this informational track document has received the
required types and degree of review coverage.

  (1.d)  Does the Document Shepherd have any specific concerns or
          issues with this document that the Responsible Area Director
          and/or the IESG should be aware of?  For example, perhaps he
          or she is uncomfortable with certain parts of the document, or
          has concerns whether there really is a need for it.  In any
          event, if the WG has discussed those issues and has indicated
          that it still wishes to advance the document, detail those
          concerns here.  Has an IPR disclosure related to this document
          been filed?  If so, please include a reference to the
          disclosure and summarize the WG discussion and conclusion on
          this issue.

The security model discusses some security model of the base
CAPWAP protocol (draft-ietf-capwap-protocol-specification-10) in the
context of IEEE802.11 binding and related deployments. The document
should be reviewed keeping in mind the context of the IEEE802.11 binding
draft, although, by and large, the analysis holds good for other bindings.
In review of base protocol and IEEE802.11 binding drafts
(draft-ietf-capwap-protocol-binding-ieee80211-06) for security, this
document will serve as a good guiding reference for IESG. This document
itself does not have any specific concerns that I am aware of; given the
wide review it has received from the sec-dir community and the
early-and-often continual tracking of the base & IEEE802.11binding CAPWAP
protocols by the authors of this document.

  (1.e)  How solid is the WG consensus behind this document?  Does it
          represent the strong concurrence of a few individuals, with
          others being silent, or does the WG as a whole understand and
          agree with it?

This document represents a very strong consensus of the WG. Many analyses
and concerns raised in the WG by the Security Advisors for WG have been
painstakingly addressed in the CAPWAP base & binding protocol drafts. This
document reflects well the state of the security model of the resulting
CAPWAP protocol.


  (1.f)  Has anyone threatened an appeal or otherwise indicated extreme
          discontent?  If so, please summarise the areas of conflict in
          separate email messages to the Responsible Area Director.  (It
          should be in a separate email because this questionnaire is
          entered into the ID Tracker.)

No one has threatened an appeal nor indicated any degree of discontent
on this document. The WG and security community that got to review this
and the CAPWAP protocol drafts have found this informational track document
valuable in reviewing the base protocol security model.