[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: draft-winter-radsec-01 published

Bernard Aboba wrote:
> To even know whether the packets are IPsec/IKE, it would be necessary to
> reassemble them.  So
> I don't see how they could be treated differently.

  They won't.  But administrators can lower the MTU for IPSec
connections until it "just works".  At that point, protocols transported
inside of IPSec are fine.

  This can't be done on the supplicant, because it only sees it's local
MTU.  There is no feedback mechanism to lower this MTU to account for
later RADIUS encapsulation.

  The IPSec solution is less about automated path MTU discovery than
administrator trial and error until "it seems to work".

  Adding a feedback mechanism to EAP for MTU could be useful.  The only
reasonable place to put this information is in the first packet sent by
the EAP server.

  Alan DeKok.

--
to unsubscribe send a message to radiusext-request@ops.ietf.org with
the word 'unsubscribe' in a single line as the message text body.
archive: <http://psg.com/lists/radiusext/>