A high Maximum Transmission Unit (MTU) value on the server side causes fragmented data packets sent to the Okta RADIUS agent, resulting in a failed connection. Lowering the MTU value on the server resolves this issue. The connection between the client and the server drops due to unresponsiveness during the authentication handshake.

• Okta Identity Engine (OIE)
• Okta Classic Engine
• RADIUS
• Troubleshooting Incomplete Client-Server Handshake

A high MTU value configured on the server side causes packet drops in the connection between a client and a server. Establishing a connection between the client and the server during Okta RADIUS agent authentication requires a correct exchange of requests and responses. For example, the client sends a "Handshake: Client Hello" request, and the server must return a "Handshake: Server Hello" response.

If packet drops occur due to the MTU value, the connection fails due to unresponsiveness. The MTU specifies the maximum transmission size of an interface. Transmission Control Protocol/Internet Protocol (TCP/IP) uses a specific MTU value for each interface. The server usually determines the MTU by negotiating with the lower-level driver, but administrators can override this value.

How is the fragmented packet issue resolved?

Lower the MTU value for the server to prevent the connection from dropping due to unresponsiveness. Different server types require different methods to lower the MTU value. Consult the specific server documentation for instructions on modifying the MTU.

How is the packet flow verified?

Capture the packet flow to identify fragmented packets and verify the correct handshake sequence by reviewing the network traffic.

NOTE: The correct packet flow is Client Hello > Server Hello + Certificate > Client Key Exchange > Access-Challenge/Accept.

Review the expected packet flow sequence to ensure the handshake completes successfully.