Setting Framed-MTU Attribute
Hi list! We have a Freeradius 3.0.17 from Debian Repositories to serve the WLAN-Enterprise authentication. It work(ed) wonderful. Now we have a second office, connected via OpenVPN. In this office, too, there are devices that need to connect to the WLAN. We use Unifi to manage our WLANs. The problem: if the device uses WPA2-Enteprise with password authentication it works via VPN, too. If the device uses a certificate, the authentication process does not work. With tcpdump I see: 7 0.326167 10.6.21.10 10.0.21.10 IPv4 1514 Fragmented IP protocol (proto=UDP 17, off=0, ID=ced8) I already searched in net and I think, I have to set the Framed-MTU attribute to a lesser value. Current it is 1400 (if I see other packets in the communication). Problem: I cannot find a way to set it... I already tried to add the attribute in mods-config/attr_filter/access_challenge and in the inner tunnel. Even is the attribute 1400... Can someone help me? Thanks Luca Bertoncello
On Mar 23, 2022, at 5:33 AM, Luca Bertoncello <L.Bertoncello@queo-group.com> wrote:
We have a Freeradius 3.0.17 from Debian Repositories to serve the WLAN-Enterprise authentication. It work(ed) wonderful.
That's good!
Problem: I cannot find a way to set it... I already tried to add the attribute in mods-config/attr_filter/access_challenge and in the inner tunnel.
The attr_filter module generally *removes* attributes. If you set Framed-MTU in the "inner-tunnel", you also need to copy it to the outer session, too. You can edit the "eap" module configuration to set "use_tunneled_reply = yes" Alan DeKok.
Hi Alan, thank you for your answer. Since I didn't found any documentation how to add an attribute, I really don't know how I can solve my problem... Could you send me an excerpt to understand how can I solve my problem? Thanks Luca Bertoncello -----Ursprüngliche Nachricht----- Von: Freeradius-Users <freeradius-users-bounces+l.bertoncello=queo-group.com@lists.freeradius.org> Im Auftrag von Alan DeKok Gesendet: Mittwoch, 23. März 2022 15:20 An: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Betreff: Re: Setting Framed-MTU Attribute On Mar 23, 2022, at 5:33 AM, Luca Bertoncello <L.Bertoncello@queo-group.com> wrote:
We have a Freeradius 3.0.17 from Debian Repositories to serve the WLAN-Enterprise authentication. It work(ed) wonderful.
That's good!
Problem: I cannot find a way to set it... I already tried to add the attribute in mods-config/attr_filter/access_challenge and in the inner tunnel.
The attr_filter module generally *removes* attributes. If you set Framed-MTU in the "inner-tunnel", you also need to copy it to the outer session, too. You can edit the "eap" module configuration to set "use_tunneled_reply = yes" Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Mar 23, 2022, at 11:01 AM, Luca Bertoncello <L.Bertoncello@queo-group.com> wrote:
Since I didn't found any documentation how to add an attribute, I really don't know how I can solve my problem...
There is tons of documentation on how to add an attribute. Read "man unlang". Or "man users". Or read the default "users" file. Or read the sites-enabled/default file. There is extensive documentation on all aspects of the server. If you can't find the documentation, then you're not looking in the right place. So... where are you looking? Google? Alan DeKok.
Hi again, Maybe there are tons of documentation, but I didn't found anything... ☹ I searched with Google, of course, and in the Freeradius-Wiki, too, but no success... I checked right now the unlang man-pages. OK, I already did something so, but always I added something after successfully authentication. Could you please send the me URL of one of this tons of documentation or a little excerpt? Really, I work on this problem since yesterday and didn't found anything... Thanks Luca Bertoncello -----Ursprüngliche Nachricht----- Von: Freeradius-Users <freeradius-users-bounces+l.bertoncello=queo-group.com@lists.freeradius.org> Im Auftrag von Alan DeKok Gesendet: Mittwoch, 23. März 2022 16:03 An: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Betreff: Re: Setting Framed-MTU Attribute On Mar 23, 2022, at 11:01 AM, Luca Bertoncello <L.Bertoncello@queo-group.com> wrote:
Since I didn't found any documentation how to add an attribute, I really don't know how I can solve my problem...
There is tons of documentation on how to add an attribute. Read "man unlang". Or "man users". Or read the default "users" file. Or read the sites-enabled/default file. There is extensive documentation on all aspects of the server. If you can't find the documentation, then you're not looking in the right place. So... where are you looking? Google? Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Mar 23, 2022, at 11:11 AM, Luca Bertoncello <L.Bertoncello@queo-group.com> wrote:
Maybe there are tons of documentation, but I didn't found anything... ☹ I searched with Google, of course, and in the Freeradius-Wiki, too, but no success...
How about the files that come with the server? There's a ton of comments in the configuration files. There are READMEs all over the configuration directories. The configuration files point to the "man" pages. Where else do we need to document things so that people can find them?
I checked right now the unlang man-pages. OK, I already did something so, but always I added something after successfully authentication.
I have no idea what that means.
Could you please send the me URL of one of this tons of documentation or a little excerpt?
Did you read my previous message?
Really, I work on this problem since yesterday and didn't found anything...
Have you tried reading the sites-available/default file as I suggested? a) yes - the answer is there b) no - stop wasting everyones time and go read it. Alan DeKok.
I'm feeling really dumb... I read the site-available/default but since I don't know what I have to search for, it's very difficult... Currently, I tried to change the mods_enabled/eap and set use_tunneled_reply to yes. I also changed the mods-config/attr_filter/access_challenge and added Framed-MTU = 1344 at the start of the "DEFAULT" section. No changes in my situation. In the sites-available/default I can't recognized how to change the Framed-MTU. Could you please give me some other tip? Thanks Luca Bertoncello -----Ursprüngliche Nachricht----- Von: Freeradius-Users <freeradius-users-bounces+l.bertoncello=queo-group.com@lists.freeradius.org> Im Auftrag von Alan DeKok Gesendet: Mittwoch, 23. März 2022 16:17 An: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Betreff: Re: Setting Framed-MTU Attribute On Mar 23, 2022, at 11:11 AM, Luca Bertoncello <L.Bertoncello@queo-group.com> wrote:
Maybe there are tons of documentation, but I didn't found anything... ☹ I searched with Google, of course, and in the Freeradius-Wiki, too, but no success...
How about the files that come with the server? There's a ton of comments in the configuration files. There are READMEs all over the configuration directories. The configuration files point to the "man" pages. Where else do we need to document things so that people can find them?
I checked right now the unlang man-pages. OK, I already did something so, but always I added something after successfully authentication.
I have no idea what that means.
Could you please send the me URL of one of this tons of documentation or a little excerpt?
Did you read my previous message?
Really, I work on this problem since yesterday and didn't found anything...
Have you tried reading the sites-available/default file as I suggested? a) yes - the answer is there b) no - stop wasting everyones time and go read it. Alan DeKok. - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 23/03/2022 15:28, Luca Bertoncello wrote:
I read the site-available/default but since I don't know what I have to search for, it's very difficult...
As Alan said, the default config is full of examples of how to update attributes. You just have to read it. Updating attributes is also documented in the unlang man pages. e.g. https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/raddb/sites-avai...
Currently, I tried to change the mods_enabled/eap and set use_tunneled_reply to yes. I also changed the mods-config/attr_filter/access_challenge and added Framed-MTU = 1344 at the start of the "DEFAULT" section. No changes in my situation.
Because as you've already been told, attr_filter *removes* attributes, it doesn't add them. update reply { Framed-MTU := 1000 } From your original post, though, I suspect this won't help. That attribute is for telling the NAS what MTU to use. It won't make its way through to any device on wifi. If you have a VPN in the way of that RADIUS server that's causing MTU problems, drop the MTU on the NAS or RADIUS server, or fix the VPN / PMTUD so that the path MTU is calculated correctly. You can't fix that by changing attributes. -- Matthew
Hi Matthew, I have an "update reply" in my server part. Of course not in post-auth, since the problem is previous... I added it to the preacct section, but of course it does not help. My problem is that the communication does not survive the site-to-site VPN (with OpenVPN). With tcpdump I see: 13 0.341592 10.6.21.10 10.0.21.10 IPv4 1516 Fragmented IP protocol (proto=UDP 17, off=0, ID=2021) Searching for this error got me the "result", I have to change the Framed-MTU and as I didn't got it after one day work, I asked the list. Now you write, this change will not help. And I see, it does not help, as you predicted. The MTU on the VPN tunnel is currently 1500. Or I did not understand what you mean? Thanks Luca Bertoncello -----Ursprüngliche Nachricht----- Von: Freeradius-Users <freeradius-users-bounces+l.bertoncello=queo-group.com@lists.freeradius.org> Im Auftrag von Matthew Newton Gesendet: Mittwoch, 23. März 2022 16:38 An: freeradius-users@lists.freeradius.org Betreff: Re: AW: Setting Framed-MTU Attribute On 23/03/2022 15:28, Luca Bertoncello wrote:
I read the site-available/default but since I don't know what I have to search for, it's very difficult...
As Alan said, the default config is full of examples of how to update attributes. You just have to read it. Updating attributes is also documented in the unlang man pages. e.g. https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/raddb/sites-avai...
Currently, I tried to change the mods_enabled/eap and set use_tunneled_reply to yes. I also changed the mods-config/attr_filter/access_challenge and added Framed-MTU = 1344 at the start of the "DEFAULT" section. No changes in my situation.
Because as you've already been told, attr_filter *removes* attributes, it doesn't add them. update reply { Framed-MTU := 1000 } From your original post, though, I suspect this won't help. That attribute is for telling the NAS what MTU to use. It won't make its way through to any device on wifi. If you have a VPN in the way of that RADIUS server that's causing MTU problems, drop the MTU on the NAS or RADIUS server, or fix the VPN / PMTUD so that the path MTU is calculated correctly. You can't fix that by changing attributes. -- Matthew - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Option 1 Does the sender of the RADIUS request actually support Framed-MTU. If not RADIUS isn’t magic it can’t make the RADIUS client do things it has not support for. Q2. Is this something like a router that’s getting the MTU update ? If that’s the case the client devices behind it will still send large packets. There are ways to try to enforce smaller MTU packets at least for TCP but its distinctly messy. For UDP (as in your example) you are at the mercy of the client which may not even look at the network MTU. A. From: Freeradius-Users <freeradius-users-bounces+alister.winfield=sky.uk@lists.freeradius.org> on behalf of Luca Bertoncello <L.Bertoncello@queo-group.com> Date: Wednesday, 23 March 2022 at 15:51 To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: [EXTERNAL] AW: AW: Setting Framed-MTU Attribute Hi Matthew, I have an "update reply" in my server part. Of course not in post-auth, since the problem is previous... I added it to the preacct section, but of course it does not help. My problem is that the communication does not survive the site-to-site VPN (with OpenVPN). With tcpdump I see: 13 0.341592 10.6.21.10 10.0.21.10 IPv4 1516 Fragmented IP protocol (proto=UDP 17, off=0, ID=2021) Searching for this error got me the "result", I have to change the Framed-MTU and as I didn't got it after one day work, I asked the list. Now you write, this change will not help. And I see, it does not help, as you predicted. The MTU on the VPN tunnel is currently 1500. Or I did not understand what you mean? Thanks Luca Bertoncello -----Ursprüngliche Nachricht----- Von: Freeradius-Users <freeradius-users-bounces+l.bertoncello=queo-group.com@lists.freeradius.org> Im Auftrag von Matthew Newton Gesendet: Mittwoch, 23. März 2022 16:38 An: freeradius-users@lists.freeradius.org Betreff: Re: AW: Setting Framed-MTU Attribute On 23/03/2022 15:28, Luca Bertoncello wrote:
I read the site-available/default but since I don't know what I have to search for, it's very difficult...
As Alan said, the default config is full of examples of how to update attributes. You just have to read it. Updating attributes is also documented in the unlang man pages. e.g. https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FFreeRADIUS%2Ffreeradius-server%2Fblob%2Fv3.0.x%2Fraddb%2Fsites-available%2Fdefault%23L864-L867&data=04%7C01%7Calister.winfield%40sky.uk%7Cfd6d152165f24f726faf08da0ce503da%7C68b865d5cf184b2b82a4a4eddb9c5237%7C0%7C0%7C637836475147410898%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=g6PQ267Fv3daSeZlcLz6OMdYT5F7Caqayy%2F4DjieTvY%3D&reserved=0
Currently, I tried to change the mods_enabled/eap and set use_tunneled_reply to yes. I also changed the mods-config/attr_filter/access_challenge and added Framed-MTU = 1344 at the start of the "DEFAULT" section. No changes in my situation.
Because as you've already been told, attr_filter *removes* attributes, it doesn't add them. update reply { Framed-MTU := 1000 } From your original post, though, I suspect this won't help. That attribute is for telling the NAS what MTU to use. It won't make its way through to any device on wifi. If you have a VPN in the way of that RADIUS server that's causing MTU problems, drop the MTU on the NAS or RADIUS server, or fix the VPN / PMTUD so that the path MTU is calculated correctly. You can't fix that by changing attributes. -- Matthew - List info/subscribe/unsubscribe? See https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freeradius.org%2Flist%2Fusers.html&data=04%7C01%7Calister.winfield%40sky.uk%7Cfd6d152165f24f726faf08da0ce503da%7C68b865d5cf184b2b82a4a4eddb9c5237%7C0%7C0%7C637836475147410898%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=Ot4EtK32HEDbUpW17zLtko1Bru8vhE3GEq%2FM%2BpagDaM%3D&reserved=0 - List info/subscribe/unsubscribe? See https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freeradius.org%2Flist%2Fusers.html&data=04%7C01%7Calister.winfield%40sky.uk%7Cfd6d152165f24f726faf08da0ce503da%7C68b865d5cf184b2b82a4a4eddb9c5237%7C0%7C0%7C637836475147410898%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=Ot4EtK32HEDbUpW17zLtko1Bru8vhE3GEq%2FM%2BpagDaM%3D&reserved=0 -------------------------------------------------------------------- This email is from an external source. Please do not open attachments or click links from an unknown or suspicious origin. Phishing attempts can be reported by using the report message button in Outlook or sending them as an attachment to phishing@sky.uk. Thank you -------------------------------------------------------------------- Information in this email including any attachments may be privileged, confidential and is intended exclusively for the addressee. The views expressed may not be official policy, but the personal views of the originator. If you have received it in error, please notify the sender by return e-mail and delete it from your system. You should not reproduce, distribute, store, retransmit, use or disclose its contents to anyone. Please note we reserve the right to monitor all e-mail communication through our internal and external networks. SKY and the SKY marks are trademarks of Sky Limited and Sky International AG and are used under licence. Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited (Registration No. 2067075), Sky Subscribers Services Limited (Registration No. 2340150) and Sky CP Limited (Registration No. 9513259) are direct or indirect subsidiaries of Sky Limited (Registration No. 2247735). All of the companies mentioned in this paragraph are incorporated in England and Wales and share the same registered office at Grant Way, Isleworth, Middlesex TW7 5QD
Hi, As far as I know, the APs (from Ubiquity) send the requests to the RADIUS. I didn't found any option to change the MTU... So as I understand you, there is no solution for my problem, is it? The only way is to configure a RADIUS in the other office, do I'm right? If so, is there any possibility to have the RADIUS in the second office configured as "slave" of the main office? So, that if I change something in the configuration in the main office, this changes will be propagated to the second office? Or maybe there is another way to solve my problem? Thanks a lot Luca Bertoncello ________________________________________ Von: Freeradius-Users <freeradius-users-bounces+l.bertoncello=queo-group.com@lists.freeradius.org> im Auftrag von Winfield, Alister (Senior Solutions Architect) via Freeradius-Users <freeradius-users@lists.freeradius.org> Gesendet: Mittwoch, 23. März 2022 23:45 An: FreeRadius users mailing list Cc: Winfield, Alister (Senior Solutions Architect) Betreff: Re: [EXTERNAL] AW: AW: Setting Framed-MTU Attribute Option 1 Does the sender of the RADIUS request actually support Framed-MTU. If not RADIUS isn’t magic it can’t make the RADIUS client do things it has not support for. Q2. Is this something like a router that’s getting the MTU update ? If that’s the case the client devices behind it will still send large packets. There are ways to try to enforce smaller MTU packets at least for TCP but its distinctly messy. For UDP (as in your example) you are at the mercy of the client which may not even look at the network MTU. A. From: Freeradius-Users <freeradius-users-bounces+alister.winfield=sky.uk@lists.freeradius.org> on behalf of Luca Bertoncello <L.Bertoncello@queo-group.com> Date: Wednesday, 23 March 2022 at 15:51 To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: [EXTERNAL] AW: AW: Setting Framed-MTU Attribute Hi Matthew, I have an "update reply" in my server part. Of course not in post-auth, since the problem is previous... I added it to the preacct section, but of course it does not help. My problem is that the communication does not survive the site-to-site VPN (with OpenVPN). With tcpdump I see: 13 0.341592 10.6.21.10 10.0.21.10 IPv4 1516 Fragmented IP protocol (proto=UDP 17, off=0, ID=2021) Searching for this error got me the "result", I have to change the Framed-MTU and as I didn't got it after one day work, I asked the list. Now you write, this change will not help. And I see, it does not help, as you predicted. The MTU on the VPN tunnel is currently 1500. Or I did not understand what you mean? Thanks Luca Bertoncello -----Ursprüngliche Nachricht----- Von: Freeradius-Users <freeradius-users-bounces+l.bertoncello=queo-group.com@lists.freeradius.org> Im Auftrag von Matthew Newton Gesendet: Mittwoch, 23. März 2022 16:38 An: freeradius-users@lists.freeradius.org Betreff: Re: AW: Setting Framed-MTU Attribute On 23/03/2022 15:28, Luca Bertoncello wrote:
I read the site-available/default but since I don't know what I have to search for, it's very difficult...
As Alan said, the default config is full of examples of how to update attributes. You just have to read it. Updating attributes is also documented in the unlang man pages. e.g. https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FFreeRADIUS%2Ffreeradius-server%2Fblob%2Fv3.0.x%2Fraddb%2Fsites-available%2Fdefault%23L864-L867&data=04%7C01%7Calister.winfield%40sky.uk%7Cfd6d152165f24f726faf08da0ce503da%7C68b865d5cf184b2b82a4a4eddb9c5237%7C0%7C0%7C637836475147410898%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=g6PQ267Fv3daSeZlcLz6OMdYT5F7Caqayy%2F4DjieTvY%3D&reserved=0
Currently, I tried to change the mods_enabled/eap and set use_tunneled_reply to yes. I also changed the mods-config/attr_filter/access_challenge and added Framed-MTU = 1344 at the start of the "DEFAULT" section. No changes in my situation.
Because as you've already been told, attr_filter *removes* attributes, it doesn't add them. update reply { Framed-MTU := 1000 } From your original post, though, I suspect this won't help. That attribute is for telling the NAS what MTU to use. It won't make its way through to any device on wifi. If you have a VPN in the way of that RADIUS server that's causing MTU problems, drop the MTU on the NAS or RADIUS server, or fix the VPN / PMTUD so that the path MTU is calculated correctly. You can't fix that by changing attributes. -- Matthew - List info/subscribe/unsubscribe? See https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freeradius.org%2Flist%2Fusers.html&data=04%7C01%7Calister.winfield%40sky.uk%7Cfd6d152165f24f726faf08da0ce503da%7C68b865d5cf184b2b82a4a4eddb9c5237%7C0%7C0%7C637836475147410898%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=Ot4EtK32HEDbUpW17zLtko1Bru8vhE3GEq%2FM%2BpagDaM%3D&reserved=0 - List info/subscribe/unsubscribe? See https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freeradius.org%2Flist%2Fusers.html&data=04%7C01%7Calister.winfield%40sky.uk%7Cfd6d152165f24f726faf08da0ce503da%7C68b865d5cf184b2b82a4a4eddb9c5237%7C0%7C0%7C637836475147410898%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=Ot4EtK32HEDbUpW17zLtko1Bru8vhE3GEq%2FM%2BpagDaM%3D&reserved=0 -------------------------------------------------------------------- This email is from an external source. Please do not open attachments or click links from an unknown or suspicious origin. Phishing attempts can be reported by using the report message button in Outlook or sending them as an attachment to phishing@sky.uk. Thank you -------------------------------------------------------------------- Information in this email including any attachments may be privileged, confidential and is intended exclusively for the addressee. The views expressed may not be official policy, but the personal views of the originator. If you have received it in error, please notify the sender by return e-mail and delete it from your system. You should not reproduce, distribute, store, retransmit, use or disclose its contents to anyone. Please note we reserve the right to monitor all e-mail communication through our internal and external networks. SKY and the SKY marks are trademarks of Sky Limited and Sky International AG and are used under licence. Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited (Registration No. 2067075), Sky Subscribers Services Limited (Registration No. 2340150) and Sky CP Limited (Registration No. 9513259) are direct or indirect subsidiaries of Sky Limited (Registration No. 2247735). All of the companies mentioned in this paragraph are incorporated in England and Wales and share the same registered office at Grant Way, Isleworth, Middlesex TW7 5QD - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Hi Matthew, so, I checked the OpenVPN configuration on the servers and I have mtu-disc set to yes. In the documentation of OpenVPN I read: --mtu-disc type Should we do Path MTU discovery on TCP/UDP channel? Only supported on OSes such as Linux that supports the necessary system call to set. 'no' -- Never send DF (Don't Fragment) frames 'maybe' -- Use per-route hints 'yes' -- Always DF (Don't Fragment) So, it seems I already use the PMTUD. Do you (or someone other) have any suggestion to solve my problem or must I install a Freeradius in the second office, too? Thanks Luca Bertoncello -----Ursprüngliche Nachricht----- Von: Freeradius-Users <freeradius-users-bounces+l.bertoncello=queo-group.com@lists.freeradius.org> Im Auftrag von Matthew Newton Gesendet: Mittwoch, 23. März 2022 16:38 An: freeradius-users@lists.freeradius.org Betreff: Re: AW: Setting Framed-MTU Attribute On 23/03/2022 15:28, Luca Bertoncello wrote:
I read the site-available/default but since I don't know what I have to search for, it's very difficult...
As Alan said, the default config is full of examples of how to update attributes. You just have to read it. Updating attributes is also documented in the unlang man pages. e.g. https://github.com/FreeRADIUS/freeradius-server/blob/v3.0.x/raddb/sites-avai...
Currently, I tried to change the mods_enabled/eap and set use_tunneled_reply to yes. I also changed the mods-config/attr_filter/access_challenge and added Framed-MTU = 1344 at the start of the "DEFAULT" section. No changes in my situation.
Because as you've already been told, attr_filter *removes* attributes, it doesn't add them. update reply { Framed-MTU := 1000 } From your original post, though, I suspect this won't help. That attribute is for telling the NAS what MTU to use. It won't make its way through to any device on wifi. If you have a VPN in the way of that RADIUS server that's causing MTU problems, drop the MTU on the NAS or RADIUS server, or fix the VPN / PMTUD so that the path MTU is calculated correctly. You can't fix that by changing attributes. -- Matthew - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
Okay simple check if you take your device sending UDP and force the configured MTU on the egress interface to be smaller than 1500 bytes then restart the application in question… does it still send 1500 byte packets ? If it does, then nothing you do with the AP, DHCP or RADIUS will have any effect. This is as likely to be a software issue as anything else. TCP flows tend to honour the MTU of the interface although in some annoying cases even this fails to work out well. Oh before I forget …If that UDP originates outside your setup forget it nothing you do will change the fragmentation here. Protocols using UDP rarely if ever negotiate an MTU / MRU value just relying on fragmentation to ensure the packets get from A to B. A. From: Freeradius-Users <freeradius-users-bounces+alister.winfield=sky.uk@lists.freeradius.org> on behalf of Luca Bertoncello <L.Bertoncello@queo-group.com> Date: Thursday, 24 March 2022 at 08:39 To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: [EXTERNAL] AW: AW: Setting Framed-MTU Attribute Hi Matthew, so, I checked the OpenVPN configuration on the servers and I have mtu-disc set to yes. In the documentation of OpenVPN I read: --mtu-disc type Should we do Path MTU discovery on TCP/UDP channel? Only supported on OSes such as Linux that supports the necessary system call to set. 'no' -- Never send DF (Don't Fragment) frames 'maybe' -- Use per-route hints 'yes' -- Always DF (Don't Fragment) So, it seems I already use the PMTUD. Do you (or someone other) have any suggestion to solve my problem or must I install a Freeradius in the second office, too? Thanks Luca Bertoncello -----Ursprüngliche Nachricht----- Von: Freeradius-Users <freeradius-users-bounces+l.bertoncello=queo-group.com@lists.freeradius.org> Im Auftrag von Matthew Newton Gesendet: Mittwoch, 23. März 2022 16:38 An: freeradius-users@lists.freeradius.org Betreff: Re: AW: Setting Framed-MTU Attribute On 23/03/2022 15:28, Luca Bertoncello wrote:
I read the site-available/default but since I don't know what I have to search for, it's very difficult...
As Alan said, the default config is full of examples of how to update attributes. You just have to read it. Updating attributes is also documented in the unlang man pages. e.g. https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FFreeRADIUS%2Ffreeradius-server%2Fblob%2Fv3.0.x%2Fraddb%2Fsites-available%2Fdefault%23L864-L867&data=04%7C01%7Calister.winfield%40sky.uk%7C3aa9370e68c44f72d07208da0d71b807%7C68b865d5cf184b2b82a4a4eddb9c5237%7C0%7C0%7C637837079911260262%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=adtrx1xJ4fTEDm8gLiLjeRO976yKq07wGQ%2F90JjS6l8%3D&reserved=0
Currently, I tried to change the mods_enabled/eap and set use_tunneled_reply to yes. I also changed the mods-config/attr_filter/access_challenge and added Framed-MTU = 1344 at the start of the "DEFAULT" section. No changes in my situation.
Because as you've already been told, attr_filter *removes* attributes, it doesn't add them. update reply { Framed-MTU := 1000 } From your original post, though, I suspect this won't help. That attribute is for telling the NAS what MTU to use. It won't make its way through to any device on wifi. If you have a VPN in the way of that RADIUS server that's causing MTU problems, drop the MTU on the NAS or RADIUS server, or fix the VPN / PMTUD so that the path MTU is calculated correctly. You can't fix that by changing attributes. -- Matthew - List info/subscribe/unsubscribe? See https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freeradius.org%2Flist%2Fusers.html&data=04%7C01%7Calister.winfield%40sky.uk%7C3aa9370e68c44f72d07208da0d71b807%7C68b865d5cf184b2b82a4a4eddb9c5237%7C0%7C0%7C637837079911260262%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=wHIVYDpAslhU%2BoCGoK8Klft8GR9NWjHU%2FitXnRaQZNI%3D&reserved=0 - List info/subscribe/unsubscribe? See https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freeradius.org%2Flist%2Fusers.html&data=04%7C01%7Calister.winfield%40sky.uk%7C3aa9370e68c44f72d07208da0d71b807%7C68b865d5cf184b2b82a4a4eddb9c5237%7C0%7C0%7C637837079911260262%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=wHIVYDpAslhU%2BoCGoK8Klft8GR9NWjHU%2FitXnRaQZNI%3D&reserved=0 -------------------------------------------------------------------- This email is from an external source. Please do not open attachments or click links from an unknown or suspicious origin. Phishing attempts can be reported by using the report message button in Outlook or sending them as an attachment to phishing@sky.uk. Thank you -------------------------------------------------------------------- Information in this email including any attachments may be privileged, confidential and is intended exclusively for the addressee. The views expressed may not be official policy, but the personal views of the originator. If you have received it in error, please notify the sender by return e-mail and delete it from your system. You should not reproduce, distribute, store, retransmit, use or disclose its contents to anyone. Please note we reserve the right to monitor all e-mail communication through our internal and external networks. SKY and the SKY marks are trademarks of Sky Limited and Sky International AG and are used under licence. Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited (Registration No. 2067075), Sky Subscribers Services Limited (Registration No. 2340150) and Sky CP Limited (Registration No. 9513259) are direct or indirect subsidiaries of Sky Limited (Registration No. 2247735). All of the companies mentioned in this paragraph are incorporated in England and Wales and share the same registered office at Grant Way, Isleworth, Middlesex TW7 5QD
Hi, I already tried to change the MTU on the APs. No changes in the situation. The UDP pakets are originated by the APs (Ubiquity). So, if I understand you, there no possibility to change the behaviour and the only solution is to install a Freeradius in the second office, correct? Thank your Luca Bertoncello ________________________________________ Von: Freeradius-Users <freeradius-users-bounces+l.bertoncello=queo-group.com@lists.freeradius.org> im Auftrag von Winfield, Alister (Senior Solutions Architect) via Freeradius-Users <freeradius-users@lists.freeradius.org> Gesendet: Donnerstag, 24. März 2022 11:51 An: FreeRadius users mailing list Cc: Winfield, Alister (Senior Solutions Architect) Betreff: Re: [EXTERNAL] AW: AW: Setting Framed-MTU Attribute Okay simple check if you take your device sending UDP and force the configured MTU on the egress interface to be smaller than 1500 bytes then restart the application in question… does it still send 1500 byte packets ? If it does, then nothing you do with the AP, DHCP or RADIUS will have any effect. This is as likely to be a software issue as anything else. TCP flows tend to honour the MTU of the interface although in some annoying cases even this fails to work out well. Oh before I forget …If that UDP originates outside your setup forget it nothing you do will change the fragmentation here. Protocols using UDP rarely if ever negotiate an MTU / MRU value just relying on fragmentation to ensure the packets get from A to B. A. From: Freeradius-Users <freeradius-users-bounces+alister.winfield=sky.uk@lists.freeradius.org> on behalf of Luca Bertoncello <L.Bertoncello@queo-group.com> Date: Thursday, 24 March 2022 at 08:39 To: FreeRadius users mailing list <freeradius-users@lists.freeradius.org> Subject: [EXTERNAL] AW: AW: Setting Framed-MTU Attribute Hi Matthew, so, I checked the OpenVPN configuration on the servers and I have mtu-disc set to yes. In the documentation of OpenVPN I read: --mtu-disc type Should we do Path MTU discovery on TCP/UDP channel? Only supported on OSes such as Linux that supports the necessary system call to set. 'no' -- Never send DF (Don't Fragment) frames 'maybe' -- Use per-route hints 'yes' -- Always DF (Don't Fragment) So, it seems I already use the PMTUD. Do you (or someone other) have any suggestion to solve my problem or must I install a Freeradius in the second office, too? Thanks Luca Bertoncello -----Ursprüngliche Nachricht----- Von: Freeradius-Users <freeradius-users-bounces+l.bertoncello=queo-group.com@lists.freeradius.org> Im Auftrag von Matthew Newton Gesendet: Mittwoch, 23. März 2022 16:38 An: freeradius-users@lists.freeradius.org Betreff: Re: AW: Setting Framed-MTU Attribute On 23/03/2022 15:28, Luca Bertoncello wrote:
I read the site-available/default but since I don't know what I have to search for, it's very difficult...
As Alan said, the default config is full of examples of how to update attributes. You just have to read it. Updating attributes is also documented in the unlang man pages. e.g. https://eur01.safelinks.protection.outlook.com/?url=https%3A%2F%2Fgithub.com%2FFreeRADIUS%2Ffreeradius-server%2Fblob%2Fv3.0.x%2Fraddb%2Fsites-available%2Fdefault%23L864-L867&data=04%7C01%7Calister.winfield%40sky.uk%7C3aa9370e68c44f72d07208da0d71b807%7C68b865d5cf184b2b82a4a4eddb9c5237%7C0%7C0%7C637837079911260262%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=adtrx1xJ4fTEDm8gLiLjeRO976yKq07wGQ%2F90JjS6l8%3D&reserved=0
Currently, I tried to change the mods_enabled/eap and set use_tunneled_reply to yes. I also changed the mods-config/attr_filter/access_challenge and added Framed-MTU = 1344 at the start of the "DEFAULT" section. No changes in my situation.
Because as you've already been told, attr_filter *removes* attributes, it doesn't add them. update reply { Framed-MTU := 1000 } From your original post, though, I suspect this won't help. That attribute is for telling the NAS what MTU to use. It won't make its way through to any device on wifi. If you have a VPN in the way of that RADIUS server that's causing MTU problems, drop the MTU on the NAS or RADIUS server, or fix the VPN / PMTUD so that the path MTU is calculated correctly. You can't fix that by changing attributes. -- Matthew - List info/subscribe/unsubscribe? See https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freeradius.org%2Flist%2Fusers.html&data=04%7C01%7Calister.winfield%40sky.uk%7C3aa9370e68c44f72d07208da0d71b807%7C68b865d5cf184b2b82a4a4eddb9c5237%7C0%7C0%7C637837079911260262%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=wHIVYDpAslhU%2BoCGoK8Klft8GR9NWjHU%2FitXnRaQZNI%3D&reserved=0 - List info/subscribe/unsubscribe? See https://eur01.safelinks.protection.outlook.com/?url=http%3A%2F%2Fwww.freeradius.org%2Flist%2Fusers.html&data=04%7C01%7Calister.winfield%40sky.uk%7C3aa9370e68c44f72d07208da0d71b807%7C68b865d5cf184b2b82a4a4eddb9c5237%7C0%7C0%7C637837079911260262%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000&sdata=wHIVYDpAslhU%2BoCGoK8Klft8GR9NWjHU%2FitXnRaQZNI%3D&reserved=0 -------------------------------------------------------------------- This email is from an external source. Please do not open attachments or click links from an unknown or suspicious origin. Phishing attempts can be reported by using the report message button in Outlook or sending them as an attachment to phishing@sky.uk. Thank you -------------------------------------------------------------------- Information in this email including any attachments may be privileged, confidential and is intended exclusively for the addressee. The views expressed may not be official policy, but the personal views of the originator. If you have received it in error, please notify the sender by return e-mail and delete it from your system. You should not reproduce, distribute, store, retransmit, use or disclose its contents to anyone. Please note we reserve the right to monitor all e-mail communication through our internal and external networks. SKY and the SKY marks are trademarks of Sky Limited and Sky International AG and are used under licence. Sky UK Limited (Registration No. 2906991), Sky-In-Home Service Limited (Registration No. 2067075), Sky Subscribers Services Limited (Registration No. 2340150) and Sky CP Limited (Registration No. 9513259) are direct or indirect subsidiaries of Sky Limited (Registration No. 2247735). All of the companies mentioned in this paragraph are incorporated in England and Wales and share the same registered office at Grant Way, Isleworth, Middlesex TW7 5QD - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
participants (4)
-
Alan DeKok -
Luca Bertoncello -
Matthew Newton -
Winfield, Alister (Senior Solutions Architect)