SoH size limiation

hi, 

during testing of our system health agent noticed when ever size of our soh
exceeds 1024 bytes, following errors -

a) on vista, wlan-autoconfig service logs "explicit eap failure
received" event and

b) on xp sp3 rc2, napagent logs "a statement of health request with
correlation id {...} - 2008-02-23 01:41:16.890z not include
the following system health-agents in statement of health: %2"
(nap_event_overflowing_shas) event.

according msdn documentation, maximum network soh size is
4000 bytes.

in addition above limit, there limit on size of
individual sha's soh?  this?

thanks,
bhagya prasad
software engineer,
avenda systems.
http://www.avendasys.com

hi bhagya prasad,

 

please refer [rfc3579], section 2.4 (fragmentation). essentially, soh being transmitted in eap-message within radius message has fit within mtu of nas-peer link  (or framed-mtu indicated nas). eap protocols need support fragmentation , reassembly overcome limit. in case, mtu seems around 1k.
 
peap [http://msdn2.microsoft.com/en-us/library/cc209011.aspx] implement fragmentation in phase-1 overcome above limitation using same schme of [rfc2716], certificate chains size longer mtu can transmitted in multiple fragments. however, peap not support fragmentation , reassembly of soh; addressed in future.
 
if switch configuration, please try change framed-mtu configuration (usual value ethernet: 1500 bytes). if have negotiated mtu between peer , nas, try change corresponding configuration.
 
since soh delivered aaa server (nps) on radius, radius (and eap on radius) limitations apply. overall soh (from shas) cannot larger 4k (and in peap case, mtu limitation apply). individual sohs have fit within size.

 

note that the 4kb limit radius perspective: radius attribute overhead means maximum payload of eap-message contained soh around 3900 bytes, without counting other radius attributes. however, there other necessary radius attributes such user-name (variable size), message-authenticator, etc., bring down maximum limit say, around 3800 bytes. this not taking mtu limit on eap-messages consideration.

so, in practice, mtu restriction on soh size peap. inreasing mtu or using compression scheme 2 possibilities work within current peap restrictions.

 

thanks,

sreenivas

Windows Server  >  Network Access Protection