topic Re: MTU issues with a VPN appliance connecting through FTD in Network Security

MTU issues with a VPN appliance connecting through FTD

Ricky Sandhu — Thu, 16 Jan 2025 15:42:17 GMT

Hi all, I have a client PC which occasionally needs to upload large amount of data to a server at another company who we have an IPSEC VPN tunnel with. I have attached a rough drawing of this setup. We recently upgraded from an ASA to Cisco FTD appliance. Client is sitting on the internal network connected to E1/1 and the VPN appliance sits inside the DMZ. I am running into issues with the MTU. From the client, I can't ping the server with packets larger than 1379 bytes. Smaller packets have no issues getting through.

I understand IPSEC adds additional overhead which should be taken into account. In the past, on IOS routers, I have been able to configure things like path MTU, and even decreased TCP MSS down to 1360 bytes but I have no idea how to do this on the FTD. I did refer to Cisco documents and configured Flex policy where I changed the default TCPMSS on the FTD to 1360 however client is still having issues. What am I doing wrong? Please advise. Thank you for your support.

Re: MTU issues with a VPN appliance connecting through FTD

ahollifield — Thu, 16 Jan 2025 17:22:48 GMT

Version? Platform? FMC or FDM?

Re: MTU issues with a VPN appliance connecting through FTD

Ricky Sandhu — Thu, 16 Jan 2025 17:40:58 GMT

Version 7.4.2.1 of FTD. Running FMC version 7.4.2.1

Thanks

Re: MTU issues with a VPN appliance connecting through FTD

MHM Cisco World — Sat, 18 Jan 2025 13:53:54 GMT

Each VPN have it PMTU to dynamically adjust the MTU
the config of PMTU you can find in IPsec setting

Advanced > IPsec > IPsec Settings

Enable Fragmentation Before Encryption: This option lets traffic travel across NAT devices that don’t support IP fragmentation. It doesn’t impede the operation of NAT devices that do support IP fragmentation.
Path Maximum Transmission Unit Aging: Check to enable Path Maximum Transmission Unit (PMTU) Aging, the interval to reset the PMTU of a Security Association (SA).
Value Reset Interval: Enter the number of minutes at which the PMTU value of an SA is reset to its original value. Valid range is 10 to 30 minutes, default is unlimited.

topic Re: MTU issues with a VPN appliance connecting through FTD in Network Security

MTU issues with a VPN appliance connecting through FTD

Re: MTU issues with a VPN appliance connecting through FTD

Re: MTU issues with a VPN appliance connecting through FTD

Re: MTU issues with a VPN appliance connecting through FTD

Each VPN have it PMTU to dynamically adjust the MTUthe config of PMTU you can find in IPsec setting

Advanced > IPsec > IPsec Settings

Each VPN have it PMTU to dynamically adjust the MTU
the config of PMTU you can find in IPsec setting