February 2026 - Freeradius-Users - lists.freeradius.org

Setting Framed-MTU in Freeradius
by Kat 13 Mar '26

13 Mar '26

Gday, Google Gemini is insisting quite strongly that, after changing fragment size in the /etc/raddb/mods-enabled/eap, I also need to put something in the post-auth part. The problem is that sometimes AI can be wrong and I cannot find alternate sources that back this claim up. My Google-fu may be weak. Google Gemini wants me to copy and paste this snippet: post-auth { update reply { Framed-MTU := 1024 } } into /etc/raddb/sites-enabled/default in the post-auth section. Gemini points to a comment block that says: "# Please do not put "unlang" configurations into the "authenticate" # section. Put them in the "post-auth" section instead. That's what # the post-auth section is for." is Google Gemini correct? Does this belong in the post-auth and is perfectly fine to do? In a previous email, https://lists.freeradius.org/pipermail/freeradius-users/2022-March/101630.h…, to this list, it sounds like it could be in sites-available/default Aren't they symlinks? I can't find anything specific to comment or uncomment, and I would have thought it would have been there, as an example. This makes me hesitant. The example is for a State attribute when I want to set a configuration. Even if the syntax is the same. So it would look like this: # Post-Authentication # Once we KNOW that the user has been authenticated, there are # additional steps we can take. post-auth { # # If you need to have a State attribute, you can # add it here. e.g. for later CoA-Request with # State, and Service-Type = Authorize-Only. # # if (!&reply:State) { # update reply { # State := "0x%{randstr:16h}" # } # } update reply { Framed-MTU := 1024 } Yay or Nay? Kat

3 2

MongoDB and v4
by Alan DeKok 05 Mar '26

05 Mar '26

As we're working to finalize v4 (real soon now!) one question which came up is MongDB. The Mongo team is currently looking into creating a fully async API for Mongo. We would need to use this in v4 in order to increase scalability. If we don't have such an API, then the Mongo drivers would be significantly slower than other databases. Their forum as a poll available at: https://feedback.mongodb.com/forums/924286-drivers/suggestions/47080057-asy… If you're interested in using Mongo with FreeRADIUS please vote on that page for their async API. Alan DeKok.

5 7

include_length in mods-available/eap
by Stephen Mellor 27 Feb '26

27 Feb '26

FreeRADIUS 3.2.4 on OpenSUSE Leap 15.6 mods-available/eap tls-config tls-common { # include_length is a flag which is # by default set to yes If set to # yes, Total Length of the message is # included in EVERY packet we send. # If set to no, Total Length of the # message is included ONLY in the # First packet of a fragment series. # include_length = yes I think I've just solved a long-standing problem for our EAP-TLS authentication for wired networks (NAS are Aruba 6200m and 3810m, supplicants are HP Windows 11). We'd see occasional problems where a laptop would start the authentication process, and freeradius would send-accept, but the laptop would never get the message. Eventually it would failover to wifi, then recognise that there was an ethernet connection, try ethernet again, same result, and repeat until the user pulled the ethernet cable out of the laptop or dock. This was quite a rare occurrence, and not consistently repeatable, so tricky to debug, though with several hundred users it seemed that there was always someone complaining (after the event!). We failed to find any pattern of hardware: although all laptops are recent HP we've a variety of USB docks. However, eventually I stumbled across this: https://community.cisco.com/t5/network-access-control/eap-tls-w-freeradius-… Sure enough, setting include_length to no does seem to have fixed our problem. It's early days yet so I'm not 100% certain, but there were a couple of laptops failing yesterday which stopped when I made the change, and I've seen none failing today. -------------------------------------------------------------------------------------------------------------------------------------------------------- This email is intended for the named recipient only. If you have received it by mistake, please (i) contact the sender by email reply; (ii) delete the email from your system; . and (iii) do not copy the email or disclose its contents to anyone. --------------------------------------------------------------------------------------------------------------------------------------------------------

2 1

Copy inner to outer identity via session-state
by Samuel LEFOL 11 Feb '26

11 Feb '26

Hello, I've configured a FreeRADIUS 3.2.7 system to run PEAP/MSCHAPv2. I would like to have Inner-Identity and Outer-Identity displayed in the logs. - in mods-enabled/eap, I have: tls-config tls-common { ... cache { enable=yes lifetime = 24 name = "EAP-EDU module" persist_dir = "${db_dir}/tlscache" } } peap { ... copy_request_to_tunnel = no } - in sites-enabled/inner-tunnel, I put: post-auth { update outer.session-state { Tmp-String-0 := &User-Name } ... } or this alternative configuration : post-auth { if (1) { update reply { Tmp-String-0 := &User-Name } update { &outer.session-state: += &reply: } } ... } as it says in the comments of the mods-enabled/eap file "If you need to send a reply attribute in the outer session, the ONLY safe way is to set "use_tunneled_reply = yes", and then update the inner-tunnel reply." - in sites-enabled/default post-auth { inner_outer } with inner_outer defined in mods-enabled/linelog file : linelog inner_outer { destination = files filename = ${logdir}/inner_outer.log format = "Packet-Type=%{%{reply:Packet-Type}:-default} Outer-User=%{User-Name} Inner-User=%{%{session-state:Tmp-String-0}:-unknown}" } The problem is that sometimes I get Packet-Type=Access-Accept Outer-User=anonymous(a)xxxx.fr Inner-User=unknown I don't understand why. Is it true that the session state may not be restored correctly to the last outer packet in certain cases such as: - TLS session resumption - specific fragmentation - specific timing - Windows fast reconnect Is this an architectural limitation in version 3.x? The only truly reliable method I've found is to log the inner identity in `inner-tunnel` and the outer identity in `default`, and to correlate via Calling-Station-Id + Event-Timestamp Is this the only method ? If possible, I would also like to be able to construct `reply.User-Name=sam(a)toto.fr` from `request.User-Name=anonymous(a)toto.fr` + `inner.User-Name=sam` Could you please help me? Best regards, -- Samuel

1 0

TEAP Chaining and Partial Success Policies
by Jan Kříž 10 Feb '26

10 Feb '26

Hello everyone, I'm following up on a thread from with the subject of "EAP-TEAP not doing 2nd inner Method" from December 2024 (https://lists.freeradius.org/pipermail/freeradius-users/2024-December/10515…) about TEAP and setting network policies based on partial success (e.g., Machine cert succeeds, but User cert fails). I would specifically like to ask for clarification about something Alan DeKok wrote in the mentioned thread: > Exactly. None of the implementations (even Windows) support this workflow. I agree that the client side is a huge hurdle here, but I’m confused because some commercial platforms like Cisco ISE and Aruba ClearPass explicitly advertise and allow admins to configure different VLANs/ACLs precisely for that partial success scenario. Since the commercial vendors seem to have found a way to achieve this, are they relying on some vendor-specific extensions or a different, non-TEAP chaining method entirely? Is it possible to configure this in FreeRADIUS at all? Any insight into how FreeRADIUS could be configured to accurately process the final result and differentiate between Machine-only, User-only success and Full success would be hugely helpful. Thanks for the clarification! Best regards, Jan K.

3 5

question regarding the Framed-MTU and the fragment_size in EAP
by Dave Wang 09 Feb '26

09 Feb '26

Hi, I noticed that in our aruba switch, it refused to work after eap-tls if I left the default config for EAP-TLS fragment_size. And what happened is, aruba switch does not send Framed-MTU in radius request, freeradius uses the fragment_size to do calculation, but in the Access-Accept response, it sends a radius attribute Framed-MTU, with value calculated based on fragment_size. However, I do not understand why freeradius sends the Framed-MTU based on the fragment_size, as it seems these two are not directly linked. The Framed-MTU is more or less used to set the MTU for this user for the following traffic. but the fragment_size is used to decide how we do the fragment in eap, and the value is restricted by the link between NAS and freeradius. Suppose the max-MTU between NAS and freeradius is 1000, so we need to set the fragment_size to be a smaller value in order to make the EAP works, but if the other links the NAS used have a higher max-MTU (say 1500), there is no reason to restrict the max-MTU to be 1000 in the end. Any reason behind how the Framed-MTU is set in the EAP-TLS case based on the fragment_size? Regards, Dave

2 1