last person joined: 7 hours ago 

Forum to discuss Enterprise security using HPE Aruba Networking NAC solutions (ClearPass), Introspect, VIA, 360 Security Exchange, Extensions, and Policy Enforcement Firewall (PEF).
Expand all | Collapse all

Framed-MTU RADIUS attribute operation clarification

This thread has been viewed 50 times
  • 1.  Framed-MTU RADIUS attribute operation clarification

    Posted Jan 06, 2019 09:33 AM

    Hello All,


    This might be a simple one, but l cannot figure out how this attribute works and what exactly it does? As per Microsoft KB:


    Framed MTU is used with EAP authentication to notify the RADIUS server about the Maximum Transmission Unit (MTU) negotiation with the client.


    In the PCAP l can see that this attribute is included in the Access-Request  packet sent by the AP but the attribute parameter is actually configured on the RADIUS:

    Screenshot 2019-01-06 at 14.25.33.png

    The value also never honored by the AP, no matter which MTU size I set on the RADIUS, AP always sends it as 1400. I am not sure how AP can even be aware of that value.





  • 2.  RE: Framed-MTU RADIUS attribute operation clarification

    Posted Jan 07, 2019 07:10 AM

    What problem are you trying to solve?

  • 3.  RE: Framed-MTU RADIUS attribute operation clarification
    Best Answer

    Posted Jan 07, 2019 08:04 AM

    @Tim thanks for your response. 


    My question is more around to get a better understanding of how the Framed-MTU attribute works. I have an access point (non-Aruba) using EAP-PEAP authentication for SSID which does not work until Framed-MTU changed.  Taking PCAP from RADIUS (NPS server), l see Client Hello message (packet 5, PCAP attached), server responses with another Access-Challenge (packet 6) but there is no Server Hello. Changing Framed-MTU on the NPS server resolves the issue but l don't know why.




  • 4.  RE: Framed-MTU RADIUS attribute operation clarification

    Posted Jan 14, 2019 07:48 PM

    ClearPass is my RADIUS server, its configured and operating with 1024.


    I am seeing EAP-TLS Client Hello frames above 1600 Bytes from my Aruba IAP virtual controller. These large frames get fragmented by the infrastrcuture and dropped by a firewall policy. Consequently, ClearPass and the wireless client do not complete EAP-TLS.


    I know that Microsoft NPS can send a Framed-MTU as part of a Network Policy []. How would I do the same sort of Framed-MTU in ClearPass? 


    EDIT: Updated this post after reading the link.