<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 5.5.2658.2">
<TITLE>MAX_PACKET_LEN setting limiting number of Cisco- Avpair's </TITLE>
</HEAD>
<BODY>
<P><FONT SIZE=2 FACE="Arial">Hi</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">After looking through the source code on v 1.148.2.3 I can see that the reason that cisco-avpair += within the users file is not being sent to the firewall for ACL's above a certain number is due to the fact that the maximum Radius Packet size is 4k.</FONT></P>
<P><FONT SIZE=2 FACE="Arial"> This is coded under radius.c for</FONT> <FONT FACE="Times New Roman">max_packet_len 4096</FONT>
</P>
<P><FONT FACE="Times New Roman"> I can modify the entry to increase the packets size and recompile, which may work in that further</FONT> <FONT SIZE=2 FACE="Arial">cisco-avpair += may be pushed to the firewall,</FONT> <FONT FACE="Times New Roman">but this will probably cause a number of other problems.</FONT></P>
<P><FONT FACE="Times New Roman"> Apart from this is there any other way to increase the number of C</FONT><FONT SIZE=2 FACE="Arial">isco-Avpair's within freeradius to be pushed to a firewall or is this the maximum ?</FONT></P>
<P><FONT SIZE=2 FACE="Arial">Thanks,</FONT>
<BR><FONT SIZE=2 FACE="Arial"> Niall</FONT>
</P>
<P><FONT SIZE=1 FACE="Tahoma">_____________________________________________ </FONT>
<BR><B><FONT SIZE=1 FACE="Tahoma">From: </FONT></B> <FONT SIZE=1 FACE="Tahoma">Niall Browne </FONT>
<BR><B><FONT SIZE=1 FACE="Tahoma">Sent: </FONT></B> <FONT SIZE=1 FACE="Tahoma">Tuesday, June 28, 2005 10:20 AM</FONT>
<BR><B><FONT SIZE=1 FACE="Tahoma">To: </FONT></B> <FONT SIZE=1 FACE="Tahoma">'freeradius-users@lists.freeradius.org'</FONT>
<BR><B><FONT SIZE=1 FACE="Tahoma">Subject: </FONT></B> <FONT SIZE=1 FACE="Tahoma">RE: Issue with increasing the number of ACL's in users file</FONT>
</P>
<P><FONT COLOR="#0000FF" SIZE=2 FACE="Arial">I sent this week and did not receive a response.</FONT>
</P>
<P><FONT COLOR="#0000FF" SIZE=2 FACE="Arial">Since then I have again gone through all files in detail, viewed countless debugs, and searched all past posts re freeradius, with no success.</FONT></P>
<P><FONT COLOR="#0000FF" SIZE=2 FACE="Arial">Anyone have any idea what may be causing this or have seen a similar problem in the past ?</FONT>
</P>
<P><FONT COLOR="#0000FF" SIZE=2 FACE="Arial">Thanks,</FONT>
<BR><FONT COLOR="#0000FF" SIZE=2 FACE="Arial"> Niall</FONT>
<BR><FONT COLOR="#0000FF" SIZE=2 FACE="Arial"> </FONT>
<BR><FONT COLOR="#0000FF" SIZE=2 FACE="Arial"> </FONT>
</P>
<P><FONT SIZE=1 FACE="Tahoma">_____________________________________________ </FONT>
<BR><B><FONT SIZE=1 FACE="Tahoma">From: </FONT></B> <FONT SIZE=1 FACE="Tahoma">Niall Browne </FONT>
<BR><B><FONT SIZE=1 FACE="Tahoma">Sent: </FONT></B> <FONT SIZE=1 FACE="Tahoma">Wednesday, June 22, 2005 8:49 PM</FONT>
<BR><B><FONT SIZE=1 FACE="Tahoma">To: </FONT></B> <FONT SIZE=1 FACE="Tahoma">'freeradius-users@lists.freeradius.org'</FONT>
<BR><B><FONT SIZE=1 FACE="Tahoma">Subject: </FONT></B> <FONT SIZE=1 FACE="Tahoma">Issue with increasing the number of ACL's in users file</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Hi</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial"> I am having a problem with an apparent limit on ACL's on my freeradius servers. I have been running this servers for a number of years, and have always had the number of ACL's on the users file below 52, and have never had any problems.</FONT></P>
<P><FONT SIZE=2 FACE="Arial"> I noticed as soon as I increased the ACL's above 52 it appeared to authenticate in the logs, however the auth connection through Cisco VPN simply continued to try to authenticate and nothing happened. As soon as I removed the ACL's below 52 and restarted it works fine.</FONT></P>
<P><FONT SIZE=2 FACE="Arial">I dumped the logs </FONT>
</P>
<P><FONT SIZE=2 FACE="Arial"> /usr/local/freeradius/sbin/radiusd -p 1647 -sfxxyz -l stdout</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial"> When I then auth'd and viewed the stdout logs, they are identical for <52 and then >52 (when compared). The only difference is that the ACL's after the magic 52 mark do not show in the stout, and this causes my timeout to fail. When I revert to <52 I can see the last ACL's and all works fine.</FONT></P>
<P><FONT SIZE=2 FACE="Arial"> I have checked through the configs including radiusd.conf however I cannot find a hard coded limitation on ACL's anywhere.</FONT></P>
<P><FONT SIZE=2 FACE="Arial"> Is anyone aware of how to resolve this ?</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Thanks in advance,</FONT>
<BR><FONT SIZE=2 FACE="Arial"> Niall</FONT>
<BR><FONT SIZE=2 FACE="Arial"> </FONT>
</P>
<BR>
</BODY>
</HTML>