MTU, WAN encryption, WLC and authentication radius server in another site

[Andrey128]

here is pretty generic case with problem:

The task is to enable encryption on WAN MPLS link. Encryption adds additional payload, so communication between local WLC and authentication radius server fails and clients cannot get wifi service.

My idea is to configure radius server somehow never send packets more than ~1000Bytes or accept framed MTU from WLC with suggestion to use smaller MTU.

I would seek for advises related to this case.

[Andrey128]

really no one knows and faced such problem?!

[patoberli]

On the WLC, under Security - Radius - Authentication you have the option "Framed MTU ". Try to set it there to your desired 1000.
You might need to do this on the Radius Server also.