MAX_PACKET_LEN setting limiting number of Cisco- Avpair's

[Niall Browne]

Hi

After looking through the source code on v 1.148.2.3 I can see that the
reason that cisco-avpair += within the users file is not being sent to the
firewall for ACL's above a certain number is due to the fact that the
maximum Radius Packet size is 4k.

 This is coded under radius.c for max_packet_len 4096

 I can modify the entry to increase the packets size and recompile, which
may work in that further cisco-avpair +=  may be pushed to the firewall, but
this will probably cause a number of other problems.

 Apart from this is there any other way to increase the number of
Cisco-Avpair's within freeradius to be pushed to a firewall or is this the
maximum ?

Thanks,
 Niall

> _____________________________________________ 
> From: 	Niall Browne  
> Sent:	Tuesday, June 28, 2005 10:20 AM
> To:	'freeradius-users at lists.freeradius.org'
> Subject:	RE: Issue with increasing the number of ACL's in users file
> 
> I sent this week and did not receive a response.
> 
> Since then I have again gone through all files in detail, viewed countless
> debugs, and searched all past posts re freeradius, with no success.
> 
> Anyone have any idea what may be causing this or have seen a similar
> problem in the past ?
> 
> Thanks,
>  Niall
>  
>  
> 
> _____________________________________________ 
> From: 	Niall Browne  
> Sent:	Wednesday, June 22, 2005 8:49 PM
> To:	'freeradius-users at lists.freeradius.org'
> Subject:	Issue with increasing the number of ACL's in users file
> 
> Hi
> 
>  I am having a problem with an apparent limit on ACL's on my freeradius
> servers. I have been running this servers for a number of years, and have
> always had the number of ACL's on the users file below 52, and have never
> had any problems.
> 
>  I noticed as soon as I increased the ACL's above 52  it appeared to
> authenticate in the logs, however the auth connection through Cisco VPN
> simply continued to try to authenticate and nothing happened. As soon as I
> removed the ACL's below 52 and restarted it works fine.
> 
> I dumped the logs 
> 
>  /usr/local/freeradius/sbin/radiusd -p 1647 -sfxxyz -l stdout
> 
>   When I then auth'd and viewed the stdout logs, they are identical for
> <52 and then >52 (when compared). The only difference is that the ACL's
> after the magic 52 mark do not show in the stout, and this causes my
> timeout to fail. When I revert to <52 I can see the last ACL's and all
> works fine.
> 
>   I have checked through the configs including radiusd.conf however I
> cannot find a hard coded limitation on ACL's anywhere.
> 
>   Is anyone aware of how to resolve this ?
> 
> Thanks in advance,
>  Niall
>  
> 
> 
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.freeradius.org/pipermail/freeradius-users/attachments/20050628/2f45582d/attachment.html>