topic reduce mtu size on vti interface in Network Security

reduce mtu size on vti interface

tiwang — Wed, 02 Apr 2025 12:53:37 GMT

hi out there

is there some "simple" way of reducing the MTU size of a tunnel interface - a VTI ? We have a VTI which after the ipsec traverses trough a MPLS tunnel and we would like to set the MTU to f.ex 1300 bytes instead of 1500 - i cannot see any options in the FMC to do this on a tunnel interface?

Re: reduce mtu size on vti interface

Rob Ingram — Wed, 02 Apr 2025 13:00:05 GMT

@tiwang "The MTU for VTIs is automatically set, according to the underlying physical interface." and "For dynamic VTI, the virtual access interface inherits the MTU from the configured tunnel source interface. If you don’t specify the tunnel source interface, the virtual access interface inherits the MTU from the source interface from which the threat defense accepts the VPN session request."

https://www.cisco.com/c/en/us/td/docs/security/secure-firewall/management-center/device-config/760/management-center-device-config-76/vpn-s2s.html

Re: reduce mtu size on vti interface

tiwang — Wed, 02 Apr 2025 13:01:54 GMT

yes probably but we do not want our physical interface which is shared among much other reduced to 1300 - i could imagen that we could handle it with a flexconfig but not sure that i want to do that

Re: reduce mtu size on vti interface

Rob Ingram — Wed, 02 Apr 2025 13:05:25 GMT

@tiwang unlikely, as the document states the VTI inherits the MTU from the physical interface.