Hi Alan,<br><br><div><span class="gmail_quote"></span><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;"><br>err, no. you need to handle those fragmented packets. where is it failing, on your network or more
<br>remotely?</blockquote><div><br>Actually, it is not failing. I got a successful authentication I was only trying to avoid fragmentation if possible.<br></div><br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
 EAP-TLS places much larger demands on the packet sizes during AAA process....several hundred<br>bytes more than PEAP (which JUST ABOUT misses fragmentation in its current form from recent<br>memory)</blockquote><div><br>
Yes I know. <br></div><br><blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">you&#39;ve GOT to pass the certs....and if you&#39;re using a larger cert (chained etc) those packets
<br>will be big.</blockquote><div><br>Actually I don&#39;t see any problem in sending server certificate and the client its own client certificate. What I would like to do is to avoid sending CA certificate.<br></div><br>
<blockquote class="gmail_quote" style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">so....whos breaking the RFCs with respect to ICMP and pmtu?&nbsp;&nbsp;;-)<br><br>alan<br>-<br>List info/subscribe/unsubscribe? See 
<a href="http://www.freeradius.org/list/users.html">http://www.freeradius.org/list/users.html</a><br></blockquote></div><br>