topic Re: Wireless access points MTU size in Wireless

Wireless access points MTU size

Don_Elledge — Thu, 26 Jun 2025 12:54:47 GMT

We're experiencing an issue with UDP packets being dropped in our environment. Our RADIUS servers are hosted in Azure Government and are connected through a network segment that includes an IPsec tunnel. We suspect that the packet drops are due to fragmentation, likely caused by the size of the certificate chains. It appears Azure may be discarding these fragmented packets at the VPN gateway. Is there a backend method—outside of what's available in the Meraki dashboard—to set a global MTU on MR36 access points?

Re: Wireless access points MTU size

aleabrahao — Thu, 26 Jun 2025 13:00:40 GMT

Meraki MR access points are 1500 bytes but you can't adjust them. I think you should consult Meraki support.

Re: Wireless access points MTU size

mloraditch — Thu, 26 Jun 2025 13:49:30 GMT

I highly suspect you may be suffering from this issue: https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-tcpip-performance-tuning

"Azure, by default, drops fragmented packets that arrive at the VM out of order, meaning the packets don't match the transmission sequence from the source endpoint. This issue can occur when packets travel over the internet or other large WANs."

ISE has started documenting this officially as an issue. See slide 15 for a summary: https://www.ciscolive.com/c/dam/r/ciscolive/emea/docs/2025/pdf/BRKSEC-2416.pdf

The workarounds in question are not usually easy to do unless you have a complete greenfield deployment

Re: Wireless access points MTU size

Don_Elledge — Thu, 26 Jun 2025 14:39:04 GMT

Agreed — that’s likely the root cause. That’s why I’m attempting to set the MTU at the access point level, so packets are generated smaller and arrive in proper sequence. However, when I try to apply the MTU using DHCP option 26, the Meraki core switch (which is acting as our DHCP server) appears to be malforming the option. See the image below for reference.

Re: Wireless access points MTU size

martin-lystad — Thu, 26 Jun 2025 14:47:31 GMT

I ran in to this issue for radius in azure as well. I was only able to apply mitigating configuration like making sure that ICMP is not blocked in the path and relly on PMTUD.

I also think Microsoft has solved the UDP fragmentation drop issue on newer hosting hardware. Maybe worth a support ticket.

Re: Wireless access points MTU size

Don_Elledge — Thu, 26 Jun 2025 15:28:13 GMT

Thanks for the information. I’m going to open a support ticket with Microsoft as well. It’s frustrating that DHCP Option 26 isn’t working properly on Meraki — especially given how many limitations we’ve encountered with the FedRAMP Meraki cloud. We’ve also considered using RADSEC, but unfortunately, that hasn't worked reliably either. It’s been a bit of a headache.

Re: Wireless access points MTU size

Raphael_L — Thu, 26 Jun 2025 15:51:38 GMT

What MS version are you running ?

Last time I tried ( couple months ago ) it was working fine

Re: Wireless access points MTU size

CMR — Thu, 26 Jun 2025 16:08:38 GMT

Hopefully its not another CS/IOS DHCP bug...

Re: Wireless access points MTU size

Philip D'Ath — Thu, 26 Jun 2025 20:22:15 GMT

Is this for RADIUS authentication? If so ...

If you use Windows, I would try doing:

ping -f -l 1500 <ip in Azure>

Reduce the 1500 by 100 bytes at a time until it starts working. Now you know what size packets you can send.

Now subtract another 100 bytes (for good luck) and try setting the Framed-MTU attribute on your RADIUS server so the AP knows to fragment packets larger than this.

Failing that, try asking Meraki Support if they can configure the Framed-MTU attribute on the AP side. I don't know if they can, but it's worth a shot.

Re: Wireless access points MTU size

Philip D'Ath — Thu, 26 Jun 2025 20:25:17 GMT

Another option is that some IPSec gateways (on-premise) can forcibly fragment packets before encrypting them. Does your IPSec gateway have any option like this?