- Freeradius-Users - lists.freeradius.org

02 Mar '26

> 2. Re: Setting Framed-MTU in Freeradius (Nick Porter) > Gday, To start with, thank you so much Nick Porter for answering! That is amazing! Thank you :-) > > This is a case of AI being confidently wrong - but there is wrong > information out there which was probably part of the training set. Based on your email, I took another look and I found reference to Framed-MTU in the etc/raddb/users file, so I uncommented that in and tried to set it to 1024. I saved the changes and restarted the server in -x. And then reconnected to check the logs. A subset of logs are provided below the email. Framed-MTU is being set to 1002 or 994, not 1024. eg: (24) Framed-MTU += 994 (24) Framed-MTU = 1002 (24) &session-state:Framed-MTU = 994 Google Gemini tells me it is because of this line: (24) [files] = noop and that the default setting of Framed-MTU that I brought back in is being disregarded because the supplicant has an identity. So do I need to put that identity in the users file and set the Framed-MTU there specifically? > If you are running into issues with fragmentation on the packets from > client to server, then usually the key is getting path MTU discovery to > work correctly.? Failing that, it is a matter of ensuring that fragments > are not getting dropped by firewalls. I would like to set the Framed-MTU because I have been asked to do so. I don't know if it will help them or not but I want to do it because I have been asked to do so. Why they want to set Framed-MTU is because Freeradius is returning many debug lines that look like this: (458002) Cleaning up request packet ID 112 with timestamp +945036 due to cleanup_delay was reached They are hoping that setting the Framed-MTU will solve this. > Example logs: (24) Received Access-Request Id 193 from 172.17.0.1:52424 to 172.17.0.2:1812 length 243 (24) User-Name = "redacted" (24) NAS-IP-Address = redacted (24) NAS-Identifier = "redacted" (24) Called-Station-Id = "2A-70-4E-AB-FB-33:T-TEC Enterprise" (24) NAS-Port-Type = Wireless-802.11 (24) Service-Type = Framed-User (24) Calling-Station-Id = "redacted" (24) Connect-Info = "CONNECT 24Mbps 802.11a" (24) Acct-Session-Id = "1B70491FD72097B8" (24) Acct-Multi-Session-Id = "33F1B622305CBD65" (24) WLAN-Pairwise-Cipher = 1027076 (24) WLAN-Group-Cipher = 1027076 (24) WLAN-AKM-Suite = 1027073 (24) Framed-MTU = 1002 (24) EAP-Message = 0x02f500060d00 (24) State = 0xc08ccb62c779c6c0c349c973c80ddb37 (24) Chargeable-User-Identity = 0x00 (24) Message-Authenticator = 0x9151c9eca3140df6df7002b31dd0faa0 (24) Restoring &session-state (24) &session-state:Framed-MTU = 994 (24) &session-state:TLS-Session-Information = "(TLS) TLS - recv TLS 1.3 Handshake, ClientHello" (24) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerHello" (24) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, Certificate" (24) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerKeyExchange" (24) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, CertificateRequest" (24) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, ServerHelloDone" (24) &session-state:TLS-Session-Information = "(TLS) TLS - recv TLS 1.2 Handshake, Certificate" (24) &session-state:TLS-Session-Information = "(TLS) TLS - recv TLS 1.2 Handshake, ClientKeyExchange" (24) &session-state:TLS-Session-Information = "(TLS) TLS - recv TLS 1.2 Handshake, CertificateVerify" (24) &session-state:TLS-Session-Information = "(TLS) TLS - recv TLS 1.2 Handshake, Finished" (24) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 ChangeCipherSpec" (24) &session-state:TLS-Session-Information = "(TLS) TLS - send TLS 1.2 Handshake, Finished" (24) &session-state:TLS-Session-Cipher-Suite = "ECDHE-RSA-AES256-GCM-SHA384" (24) &session-state:TLS-Session-Version = "TLS 1.2" (24) # Executing section authorize from file /etc/freeradius/sites-enabled/default (24) authorize { (24) policy filter_username { (24) if (&User-Name) { (24) if (&User-Name) -> TRUE (24) if (&User-Name) { (24) if (&User-Name =~ / /) { (24) if (&User-Name =~ / /) -> FALSE (24) if (&User-Name =~ /@[^@]*@/ ) { (24) if (&User-Name =~ /@[^@]*@/ ) -> FALSE (24) if (&User-Name =~ /\.\./ ) { (24) if (&User-Name =~ /\.\./ ) -> FALSE (24) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) { (24) if ((&User-Name =~ /@/) && (&User-Name !~ /(a)(.+)\.(.+)$/)) -> FALSE (24) if (&User-Name =~ /\.$/) { (24) if (&User-Name =~ /\.$/) -> FALSE (24) if (&User-Name =~ /(a)\./) { (24) if (&User-Name =~ /(a)\./) -> FALSE (24) } # if (&User-Name) = notfound (24) } # policy filter_username = notfound (24) [preprocess] = ok (24) [digest] = noop (24) suffix: Checking for suffix after "@" (24) suffix: No '@' in User-Name = "redacted", looking up realm NULL (24) suffix: No such realm "NULL" (24) [suffix] = noop (24) eap: Peer sent EAP Response (code 2) ID 245 length 6 (24) eap: No EAP Start, assuming it's an on-going EAP conversation (24) [eap] = updated (24) [files] = noop (24) [expiration] = noop (24) [logintime] = noop (24) } # authorize = updated (24) Found Auth-Type = eap (24) # Executing group from file /etc/freeradius/sites-enabled/default (24) authenticate { (24) eap: Removing EAP session with state 0xc08ccb62c779c6c0 (24) eap: Previous EAP request found for state 0xc08ccb62c779c6c0, released from the list (24) eap: Peer sent packet with method EAP TLS (13) (24) eap: Calling submodule eap_tls to process data (24) eap_tls: (TLS) Peer ACKed our handshake fragment. handshake is finished (24) eap: Sending EAP Success (code 3) ID 245 length 4 (24) eap: Freeing handler (24) [eap] = ok (24) } # authenticate = ok (24) # Executing section post-auth from file /etc/freeradius/sites-enabled/default (24) post-auth { (24) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) { (24) if (session-state:User-Name && reply:User-Name && request:User-Name && (reply:User-Name == request:User-Name)) -> FALSE (24) update { (24) &reply::Framed-MTU += &session-state:Framed-MTU[*] -> 994 (24) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - recv TLS 1.3 Handshake, ClientHello' (24) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.2 Handshake, ServerHello' (24) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.2 Handshake, Certificate' (24) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.2 Handshake, ServerKeyExchange' (24) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.2 Handshake, CertificateRequest' (24) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.2 Handshake, ServerHelloDone' (24) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - recv TLS 1.2 Handshake, Certificate' (24) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - recv TLS 1.2 Handshake, ClientKeyExchange' (24) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - recv TLS 1.2 Handshake, CertificateVerify' (24) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - recv TLS 1.2 Handshake, Finished' (24) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.2 ChangeCipherSpec' (24) &reply::TLS-Session-Information += &session-state:TLS-Session-Information[*] -> '(TLS) TLS - send TLS 1.2 Handshake, Finished' (24) &reply::TLS-Session-Cipher-Suite += &session-state:TLS-Session-Cipher-Suite[*] -> 'ECDHE-RSA-AES256-GCM-SHA384' (24) &reply::TLS-Session-Version += &session-state:TLS-Session-Version[*] -> 'TLS 1.2' (24) } # update = noop (24) [exec] = noop (24) policy remove_reply_message_if_eap { (24) if (&reply:EAP-Message && &reply:Reply-Message) { (24) if (&reply:EAP-Message && &reply:Reply-Message) -> FALSE (24) else { (24) [noop] = noop (24) } # else = noop (24) } # policy remove_reply_message_if_eap = noop (24) if (EAP-Key-Name && &reply:EAP-Session-Id) { (24) if (EAP-Key-Name && &reply:EAP-Session-Id) -> FALSE (24) } # post-auth = noop (24) Sent Access-Accept Id 193 from 172.17.0.2:1812 to 172.17.0.1:52424 length 173 (24) MS-MPPE-Recv-Key = 0x9e7d6bc3e620c918df655f5b6f3df6354afb8a122a23d067e577eeceef5d41dd (24) MS-MPPE-Send-Key = 0x30c4a64e47a5fadfdbe66e814dda937c5a16d504439fdb0c7e21602acbc3664b (24) EAP-Message = 0x03f50004 (24) Message-Authenticator = 0x00000000000000000000000000000000 (24) User-Name = "redacted" (24) Framed-MTU += 994 (24) Finished request Waking up in 4.8 seconds.

2 1

include_length in mods-available/eap
by Stephen Mellor 27 Feb '26

27 Feb '26

FreeRADIUS 3.2.4 on OpenSUSE Leap 15.6 mods-available/eap tls-config tls-common { # include_length is a flag which is # by default set to yes If set to # yes, Total Length of the message is # included in EVERY packet we send. # If set to no, Total Length of the # message is included ONLY in the # First packet of a fragment series. # include_length = yes I think I've just solved a long-standing problem for our EAP-TLS authentication for wired networks (NAS are Aruba 6200m and 3810m, supplicants are HP Windows 11). We'd see occasional problems where a laptop would start the authentication process, and freeradius would send-accept, but the laptop would never get the message. Eventually it would failover to wifi, then recognise that there was an ethernet connection, try ethernet again, same result, and repeat until the user pulled the ethernet cable out of the laptop or dock. This was quite a rare occurrence, and not consistently repeatable, so tricky to debug, though with several hundred users it seemed that there was always someone complaining (after the event!). We failed to find any pattern of hardware: although all laptops are recent HP we've a variety of USB docks. However, eventually I stumbled across this: https://community.cisco.com/t5/network-access-control/eap-tls-w-freeradius-… Sure enough, setting include_length to no does seem to have fixed our problem. It's early days yet so I'm not 100% certain, but there were a couple of laptops failing yesterday which stopped when I made the change, and I've seen none failing today. -------------------------------------------------------------------------------------------------------------------------------------------------------- This email is intended for the named recipient only. If you have received it by mistake, please (i) contact the sender by email reply; (ii) delete the email from your system; . and (iii) do not copy the email or disclose its contents to anyone. --------------------------------------------------------------------------------------------------------------------------------------------------------

2 1

Copy inner to outer identity via session-state
by Samuel LEFOL 11 Feb '26

11 Feb '26

Hello, I've configured a FreeRADIUS 3.2.7 system to run PEAP/MSCHAPv2. I would like to have Inner-Identity and Outer-Identity displayed in the logs. - in mods-enabled/eap, I have: tls-config tls-common { ... cache { enable=yes lifetime = 24 name = "EAP-EDU module" persist_dir = "${db_dir}/tlscache" } } peap { ... copy_request_to_tunnel = no } - in sites-enabled/inner-tunnel, I put: post-auth { update outer.session-state { Tmp-String-0 := &User-Name } ... } or this alternative configuration : post-auth { if (1) { update reply { Tmp-String-0 := &User-Name } update { &outer.session-state: += &reply: } } ... } as it says in the comments of the mods-enabled/eap file "If you need to send a reply attribute in the outer session, the ONLY safe way is to set "use_tunneled_reply = yes", and then update the inner-tunnel reply." - in sites-enabled/default post-auth { inner_outer } with inner_outer defined in mods-enabled/linelog file : linelog inner_outer { destination = files filename = ${logdir}/inner_outer.log format = "Packet-Type=%{%{reply:Packet-Type}:-default} Outer-User=%{User-Name} Inner-User=%{%{session-state:Tmp-String-0}:-unknown}" } The problem is that sometimes I get Packet-Type=Access-Accept Outer-User=anonymous(a)xxxx.fr Inner-User=unknown I don't understand why. Is it true that the session state may not be restored correctly to the last outer packet in certain cases such as: - TLS session resumption - specific fragmentation - specific timing - Windows fast reconnect Is this an architectural limitation in version 3.x? The only truly reliable method I've found is to log the inner identity in `inner-tunnel` and the outer identity in `default`, and to correlate via Calling-Station-Id + Event-Timestamp Is this the only method ? If possible, I would also like to be able to construct `reply.User-Name=sam(a)toto.fr` from `request.User-Name=anonymous(a)toto.fr` + `inner.User-Name=sam` Could you please help me? Best regards, -- Samuel

1 0

TEAP Chaining and Partial Success Policies
by Jan Kříž 10 Feb '26

10 Feb '26

Hello everyone, I'm following up on a thread from with the subject of "EAP-TEAP not doing 2nd inner Method" from December 2024 (https://lists.freeradius.org/pipermail/freeradius-users/2024-December/10515…) about TEAP and setting network policies based on partial success (e.g., Machine cert succeeds, but User cert fails). I would specifically like to ask for clarification about something Alan DeKok wrote in the mentioned thread: > Exactly. None of the implementations (even Windows) support this workflow. I agree that the client side is a huge hurdle here, but I’m confused because some commercial platforms like Cisco ISE and Aruba ClearPass explicitly advertise and allow admins to configure different VLANs/ACLs precisely for that partial success scenario. Since the commercial vendors seem to have found a way to achieve this, are they relying on some vendor-specific extensions or a different, non-TEAP chaining method entirely? Is it possible to configure this in FreeRADIUS at all? Any insight into how FreeRADIUS could be configured to accurately process the final result and differentiate between Machine-only, User-only success and Full success would be hugely helpful. Thanks for the clarification! Best regards, Jan K.

3 5

question regarding the Framed-MTU and the fragment_size in EAP
by Dave Wang 09 Feb '26

09 Feb '26

Hi, I noticed that in our aruba switch, it refused to work after eap-tls if I left the default config for EAP-TLS fragment_size. And what happened is, aruba switch does not send Framed-MTU in radius request, freeradius uses the fragment_size to do calculation, but in the Access-Accept response, it sends a radius attribute Framed-MTU, with value calculated based on fragment_size. However, I do not understand why freeradius sends the Framed-MTU based on the fragment_size, as it seems these two are not directly linked. The Framed-MTU is more or less used to set the MTU for this user for the following traffic. but the fragment_size is used to decide how we do the fragment in eap, and the value is restricted by the link between NAS and freeradius. Suppose the max-MTU between NAS and freeradius is 1000, so we need to set the fragment_size to be a smaller value in order to make the EAP works, but if the other links the NAS used have a higher max-MTU (say 1500), there is no reason to restrict the max-MTU to be 1000 in the end. Any reason behind how the Framed-MTU is set in the EAP-TLS case based on the fragment_size? Regards, Dave

2 1

Guidelines for upgrading freeradius installation? (3.0.19 -> 3.2.8)
by uj2.hahn＠posteo.de 29 Jan '26

29 Jan '26

Hi, all! Years ago (2020) I implemented a pretty basic freeradius installation (authentication only) in a school for WLAN access. That time I installed version 3.0.19 on a virtual server (Ubuntu 19.04) and used Samba to connect to Active Directory on Windows Server. This is still working fine but I think it is time for a larger upgrade of all involved components. Is there any recommendation/cookbook/guideline how to do that upgrade in the most efficient way with minimal effort? Of course I can do everything from scratch on a second virtual machine. Is that the preferred way? Or can I copy the freeradius configuration over? Any changes I have to do then? Your help is very welcome! Regards Uwe

3 3

Re: Freeradius-Users Digest, Vol 249, Issue 17
by Ciummi 26 Jan '26

26 Jan '26

Hi, When is version 3.2.9 expected to be officially released? BR Andrea Il giorno sab 24 gen 2026 alle ore 13:00 < freeradius-users-request(a)lists.freeradius.org> ha scritto: > Send Freeradius-Users mailing list submissions to > freeradius-users(a)lists.freeradius.org > > To subscribe or unsubscribe via the World Wide Web, visit > https://lists.freeradius.org/mailman/listinfo/freeradius-users > or, via email, send a message with subject or body 'help' to > freeradius-users-request(a)lists.freeradius.org > > You can reach the person managing the list at > freeradius-users-owner(a)lists.freeradius.org > > When replying, please edit your Subject line so it is more specific > than "Re: Contents of Freeradius-Users digest..." > > > Today's Topics: > > 1. Re: FreeRADIUS v.3.2.8 - preprocess: ERROR: regex evaluation > failed with code (-51): NULL argument passed with non-zero length > (Alan DeKok) > 2. Policy on AI Agents (Alan DeKok) > > > ---------------------------------------------------------------------- > > Message: 1 > Date: Fri, 23 Jan 2026 07:59:45 -0500 > From: Alan DeKok <alan.dekok(a)inkbridge.io> > To: FreeRadius users mailing list > <freeradius-users(a)lists.freeradius.org> > Cc: luciana.coppola(a)yahoo.it > Subject: Re: FreeRADIUS v.3.2.8 - preprocess: ERROR: regex evaluation > failed with code (-51): NULL argument passed with non-zero length > Message-ID: <57D78A3C-62EC-47E5-906A-6DBB00C784AD(a)inkbridge.io> > Content-Type: text/plain; charset="utf-8" > > On Jan 23, 2026, at 3:57?AM, Ciummi <ciummi(a)gmail.com> wrote: > > I was using FreeRADIUS version 3.2.6 for x86_64-redhat-linux-gnu (Red Hat > > Enterprise Linux release 9.4), > > with Oracle Database 19 as the backend. > > > > I encountered some memory issues, so I upgraded to version 3.2.8, > > ... > > Wed Jan 21 16:36:50 2026 : ERROR: (0) preprocess: ERROR: regex evaluation > > failed with code (-51): NULL argument passed with non-zero length > > The PCRE libraries use a JIT, and the local OS has disabled JIT > compilation. You can either enable that (somehow) locally, or just the > v3.2.x branch from GitHub. > > We've already pushed a fix for this, which will be in 3.2.9. > > Alan DeKok. > > >

2 1

Freeradius Binary for Debian 13 trixie
by Conrad Classen 26 Jan '26

26 Jan '26

Hi I would like to to know when/if the binary for Freeradius will be provided that will install on Debian 13 trixie? The version for Debian 12 bookworm fails using the packages.inkbridgenetworks.com provided. The following packages have unmet dependencies: freeradius : Depends: libperl5.36 (>= 5.36.0) but it is not installable Recommends: freeradius-python3 but it is not going to be installed freeradius-utils : Depends: libpcre3 but it is not installable libfreeradius3 : Depends: libpcre3 but it is not installable Many Thanks Con

2 1

I want to contribute to the project
by Agung Riyadi 24 Jan '26

24 Jan '26

First contribution I want to share my docker setup for anyone who need quick Freeradius+postgresql+backend(nodejs)+adminer in ~5 minutes. Just run the script from terminal. : Ready OUT-OF-THE-BOX to use packages bundle, with 4 services in docker-compose.yml configuration: 1. freeradius server 3.2.7 as radius server. 2. postgresql 17 3. nodejs backend (akses: http://host_ip_address:5000) as basic custom UI that can be use as basis of developing. 4. adminer (http://host_ip_address:8082) as additional general UI that can directly access the database. Requirement: 1. Internet connection ON the host. 2. Linux host with sudo or root access. 3. docker and docker compose must be installed. I use docker -v Docker version 29.1.5, build 0e6fee6 and I was using this script to install docker : curl -fsSL https://get.docker.com | sh 4. bash terminal 5. git must be installed. JUST COPY ALL THE SCRIPT TO THE TERMINAL. Usage : ```bash # Must run in bash shell because of hostip.sh need it (cant use sh shell). # Store the directory name in a variable project_name="radiusapp" target_dir=$project_name # you can change to any literal string as directory name # Check if the directory exists, and create it if it doesn't if [ ! -d "$target_dir" ]; then mkdir -p "$target_dir" cd "$target_dir" || exit 1 git clone https://github.com/lfsegoro/"$project_name".git . else cd "$target_dir" || exit 1 git pull # !!WARNING!! this will overwrite the directory content fi # to get the variable needed set HOST_IP=$(bash ./backend/hostip.sh) #export HOST_IP echo "HOST_IP=$HOST_IP" > ./.env # build process docker compose build --no-cache ################################################### # If you already do above you can also run below # so you dont need to git clone and build again # optional : docker rm -f $(docker ps -aq -f status=exited) >/dev/null 2>&1 || true docker network prune -f >/dev/null 2>&1 || true docker compose up true ``` 4. Let the the script do autmatic pull and installing. 5. access from the UI. http://host_ip_address:5000 or http://host_ip_address:8082 6. test using Ntradping or directly from NAS like mikrotik. You can learn the detail on the docker-compose.yml if you want to see the password or make modification. The database already have sample username for testing. you can check the radcheck table. You can test using ntradping or directly from a NAS like mikrotik. Detailed note: - username and password user testing, 1 entry in 'radcheck' table. - all host/nas allowed, to see the secret: 1 entry in 'nas' table. - adminer can have access to all table, make sure choose Postgresql, dbHost ip ADDRESS, username/password you can see in docker-compose.yml - the only difference with default freeradius config is modified modules only 'sql' inside the /etc/freeradius/mods-enable - it collude many ports udp and tcp, 1812, 1813, 3799, 5432, 5000, 8082, 8080. if you doing this kind of thing over and over you will learn a lot backend, frontend and tcp/ip etc.

1 0

Policy on AI Agents
by Alan DeKok 23 Jan '26

23 Jan '26

We've started to get PRs which are untested AI slop. As such, we've created a policy to clarify when / where AI can be used. In short, AI is good for API completion, summaries, suggesting certain docs. PRs which are clearly untested AI slop will result in the submitter being banned from the GitHub repository. There isn't enough time in the day to review untested garbage code. https://github.com/FreeRADIUS/freeradius-server/blob/master/AGENTS.md

1 0