Configurable Framed-MTU on Cisco Catalyst 9800

Configurable Framed-MTU on Cisco Catalyst 9800

First Published: Sept 9, 2021

Last Updated: Sept 9, 2021

 

Table of Contents

Introduction. 1

Prerequisites. 2

Requirements. 2

Components Used. 2

Configuration. 2

AAA Attribute List. 2

Wireless AAA Policy. 3

Wireless Policy Profile. 3

Verify/Troubleshooting. 3

 

 

 

Introduction

This document describes how to configure Framed Maximum Transmission Unit (MTU) size for RADIUS on a 9800 WLC. When sent as part of the RADIUS-REQUEST message, the framed-mtu attribute will control the packet size for the RADIUS-RESPONSE message that is sent from the RADIUS server.  The controller uses this to inform the RADIUS server about the CAPWAP MTU between the controller and AP. By default, the 9800 dynamically populates the framed-mtu attribute with the CAPWAP MTU value. However, in cases where the MTU between the controller and the RADIUS server is less than the CAPWAP MTU between the controller and AP, setting the framed-mtu value to match the MTU between the controller and RADIUS server will avoid any packet fragmentation.

Note: For a better reading experience, we recommend that you view this document with your browser window in full-screen mode.

Note: The documentation set for this product strives to use bias-free language. For purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product.

Prerequisites

Cisco recommends that you have knowledge of these topics:

■      Catalyst Wireless 9800 configuration model

■      AAA and RADIUS concepts

Components Used

The information in this document is based on these software and hardware versions:

■      Catalyst 9800 Wireless Controller Series (Catalyst 9800-CL)

■      Cisco IOSÒ-XE Bengaluru 17.04.01

The information in this document was created from the devices in a specific lab environment. All of the devices used in this document started with a cleared (default) configuration. If your network is live, make sure that you understand the potential impact of any command.

Configuration

To configure framed MTU size for RADIUS, you will need to configure:

1.     AAA attribute list defining the MTU size

2.     Wireless AAA Policy with the AAA attribute list applied

3.     Wireless Policy Profile with the Wireless AAA Policy applied.

At the time of writing the document, these configurations can be done via the CLI only.

AAA Attribute List

1.     Connect to the CLI of the 9800 using your preferred method, like SSH

2.     Create the AAA attribute list with the following commands:

9800CL# configure terminal

9800CL(config)# aaa attribute list custom-framed-mtu

9800CL(config-attr-list# attribute type framed-mtu 1300

The framed-mtu attribute can be configured with any number between 0 and 4294967294.

■      Note: Ensure that the configured framed-mtu value is less than or equal to the CAPWAP MTU. This is because the EAP message received in Access-Challenge message must not  exceed the CAPWAP MTU in order to avoid EAP fragmentation. 

Wireless AAA Policy

1.     For the required Wireless AAA Policy, enter the following commands in the CLI to apply the AAA attribute list defining the framed MTU size

9800CL# configure terminal

9800CL(config)# wireless aaa policy FRAMED-MTU

9800CL(config-aaa-policy)#attrlist authentication custom-framed-mtu

Wireless Policy Profile

1.     For the required Wireless Policy, enter the following commands in the CLI to apply the Wireless AAA Policy

9800CL# configure terminal

9800CL(config)# wireless profile policy CUSTOM-MTU

9800CL(config-wireless-policy)# aaa-policy FRAMED-MTU

 

Verify/Troubleshooting

Create a packet capture of a RADIUS request. In the Attribute Value Pairs, verify that the Framed-MTU value matches what was configured.

 

If it does not match, narrow down what has been applied by running the following commands.

show run aaa attribute

show run | sec wireless aaa

show run | sec wireless profile policy

The framed-mtu should show the desired MTU size for the deployment.

9800CL# show run aaa attribute

!

!

aaa attribute list custom-framed-mtu

 attribute type framed-mtu 1300

!

The Wireless AAA Policy should contain the AAA attribute list with the custom framed MTU size.

9800CL# show run | sec wireless aaa

wireless aaa policy FRAMED-MTU

 attrlist authentication custom-framed-mtu

 

The Wireless Policy Profile should contain the configured Wireless AAA Policy that contains the custom framed MTU size.

9800CL# show run | sec wireless profile policy

… Output is condensed

wireless profile policy CUSTOM-MTU

 aaa-policy FRAMED-MTU

 

… Output is condensed

 

THE SPECIFICATIONS AND INFORMATION REGARDING THE PRODUCTS IN THIS MANUAL ARE SUBJECT TO CHANGE WITHOUT NOTICE. ALL STATEMENTS, INFORMATION, AND RECOMMENDATIONS IN THIS MANUAL ARE BELIEVED TO BE ACCURATE BUT ARE PRESENTED WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED. USERS MUST TAKE FULL RESPONSIBILITY FOR THEIR APPLICATION OF ANY PRODUCTS.

THE SOFTWARE LICENSE AND LIMITED WARRANTY FOR THE ACCOMPANYING PRODUCT ARE SET FORTH IN THE INFORMATION PACKET THAT SHIPPED WITH THE PRODUCT AND ARE INCORPORATED HEREIN BY THIS REFERENCE. IF YOU ARE UNABLE TO LOCATE THE SOFTWARE LICENSE OR LIMITED WARRANTY, CONTACT YOUR CISCO REPRESENTATIVE FOR A COPY.

The Cisco implementation of TCP header compression is an adaptation of a program developed by the University of California, Berkeley (UCB) as part of UCB’s public domain version of the UNIX operating system. All rights reserved. Copyright © 1981, Regents of the University of California.

NOTWITHSTANDING ANY OTHER WARRANTY HEREIN, ALL DOCUMENT FILES AND SOFTWARE OF THESE SUPPLIERS ARE PROVIDED “AS IS” WITH ALL FAULTS. CISCO AND THE ABOVE-NAMED SUPPLIERS DISCLAIM ALL WARRANTIES, EXPRESSED OR IMPLIED, INCLUDING, WITHOUT LIMITATION, THOSE OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OR ARISING FROM A COURSE OF DEALING, USAGE, OR TRADE PRACTICE.

IN NO EVENT SHALL CISCO OR ITS SUPPLIERS BE LIABLE FOR ANY INDIRECT, SPECIAL, CONSEQUENTIAL, OR INCIDENTAL DAMAGES, INCLUDING, WITHOUT LIMITATION, LOST PROFITS OR LOSS OR DAMAGE TO DATA ARISING OUT OF THE USE OR INABILITY TO USE THIS MANUAL, EVEN IF CISCO OR ITS SUPPLIERS HAVE BEEN ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.

Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.

All printed copies and duplicate soft copies are considered un-Controlled copies and the original on-line version should be referred to for latest version.

Cisco has more than 200 offices worldwide. Addresses, phone numbers, and fax numbers are listed on the Cisco website at www.cisco.com/go/offices.

Cisco and the Cisco logo are trademarks or registered trademarks of Cisco and/or its affiliates in the U.S. and other countries. To view a list of Cisco trademarks, go to this URL: https://www.cisco.com/c/en/us/about/legal/trademarks.html. Third-party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1721R)

© 2021 Cisco Systems, Inc. All rights reserved.