Problem Radius over VPN

[Alan DeKok]

On Apr 13, 2022, at 9:23 AM, Luca Bertoncello <L.Bertoncello at queo-group.com> wrote:
> I didn't changed the fragment_size, but I tried to reduce it and set it to 800.
> Unfortunately no changes in the situation...

  Then something else is going on in your local configuration.

  The EAP module will limit the EAP-Message attribute to "fragment_size".  So if the RADIUS packets are still >1500 bytes, then the problem isn't EAP.

  Look at the debug output.  What attributes are in the Access-Challenge responses?  There should be:

EAP-Message
State

  And not really much else.  If you have tons of other attributes in the Access-Challenge packets, that's the problem.  

  Go to sites-enabled/default, and look for this text:

	#
	#  Filter access challenges.
	#
	Post-Auth-Type Challenge {
#		remove_reply_message_if_eap
#		attr_filter.access_challenge.post-auth
	}


 Uncomment the "attr_filter.access_challenge.post-auth" line, and the Access-Challenge packets should get a lot smaller.

  Alan DeKok.