Network Performance and "no ip unreachables"

[mcrockett]

I am investigating network performance issues on a DMVPN network. There is evidence that packet fragmentation is occurring on traffic traversing DMVPN tunnels indicating that Path MTU Discovery is failing.

I've reviewed some of the router configurations and noticed that "no ip unreachables" is set on every interface including the multilink and tunnel interfaces. This doesn't seem to be the correct usage.

Is there a good discussion of what this command is supposed to accomplish and where it is applied in the flow through each interface?

A side issue is what is the proper way to define the MTU to prevent packet fragmentation of data passing through a tunnel? Using "ip tcp mss" does not seem a complete solution. Shouldn't "ip mtu" be used?

[andreas.larsen]

We are using ip mtu for a wan like we have for which we run MPLS over. I used the command ip mtu under the interface and that works just fine for us.

[mcrockett]

You have "ip mtu" defined for the Tunnel0 virtual device. Do you have "no ip unreachables" defined on the interface as well?

If I understand Cisco's documentation correctly, defining "no ip unreachables" on an interface results in all ICMP Type 3 packets being discarded regardless of whether the are received or generated by the interface.