topic IP MTU issues across GRE/IPSEC Tunnels in Network Security

IP MTU issues across GRE/IPSEC Tunnels

bob.forster — Fri, 21 Feb 2020 11:00:09 GMT

Any links/insight into IP MTU issues in an MS environment with Cisco Routing IOS VPN GRE/IPSEC Tunnels

Thanks,

Bob

Re: IP MTU issues across GRE/IPSEC Tunnels

Mark Yeates — Wed, 10 Sep 2008 21:01:05 GMT

Bob,

There are some MTU and TCP MSS issues associated with GRE tunnels. Generally it is associated with web browsing and file shares. Here are a few guides to help you out for your install.

http://www.cisco.com/en/US/tech/tk827/tk369/technologies_tech_note09186a0080093f1f.shtml

http://www.cisco.com/en/US/tech/tk827/tk369/technologies_white_paper09186a00800d6979.shtml

HTH,

Mark

Re: IP MTU issues across GRE/IPSEC Tunnels

leej — Fri, 12 Sep 2008 16:57:09 GMT

adjust your tunnel interface mtu size to 1420 and issue the command ip tcp adjust-mss 1380.

Re: IP MTU issues across GRE/IPSEC Tunnels

bob.forster — Fri, 12 Sep 2008 20:57:27 GMT

Yeah, that's what I typically do IP MTU 1420 on the outside interface (which forces all VPN Tunnels to 1396) and then IP TCP MSS 1270.

Works for over 100 tunnels I have with other clients, but this client still sees some Group Policy issues.

We are looking at doing IP MTU right on the client Registry Keys and this seems to clear up ALL issues (With Routers set to NO IP MTU on Outside physical interface, IP MTU 1400 on Tunnels and TCP MSS 1270 on Inside interface)

Thanks for the input.

Bob

Re: IP MTU issues across GRE/IPSEC Tunnels

jonesandrew — Sun, 14 Sep 2008 22:47:18 GMT

hi,

we've had a problem with w2k3 servers and GRE tunnels, where the servers would start to ignore the ICMP packet too big messages from the routers after a little while, causing TCP sessions to fail.

info on the bug is here: http://support.microsoft.com/kb/898060/

setting the mtu in the registry to an approipiate value, or installing the patch / service pack in the link will fix that issue.

Cheers.

Re: IP MTU issues across GRE/IPSEC Tunnels

rmalloy — Thu, 25 Sep 2008 13:11:00 GMT

We had issues with the MTU of the GRE tunnel with users accessing an Exchange server. We had to bump the MTU of the tunnel up to 1600 to account for the MTU plus the 24-byte GRE overhead.

See this link on CCO:

http://www.cisco.com/en/US/tech/tk827/tk369/technologies_tech_note09186a0080093f1f.shtml

There is more detailed info at:

http://www.cisco.com/en/US/tech/tk827/tk369/technologies_white_paper09186a00800d6979.shtml