So as I mention before some topic is very interest and it is not about the NAT and other regular issue that can easily solve but like this issue is very interest.
So Friend,
Why DTLS fallback into TLS ?
if you specify other port than 443 then some FW in path can be block these port and hence make any connect fallback to TLS connection.
Note:- need DPD for fallback
Why issue with the MTU?
the any connect build two-tunnel
one tunnel is parent which use to exchange the cipher auth between client and ASA
second TLS Or DTLS "depend"
during the parent tunnel there are two value send to client
1-DTLS MTU
2-TLS MTU
client will use DTLS MTU value
do netsh ipv4 show interface
DTLS MTU value for default large than TLS MTU
ASA use TLS MTU value
NOW
client will use DTLS MTU in TCP MSS and send this value to server behind the ASA
server send packet with value equal to DTLS MTU with "DF bit set"
ASA see this value BUT because it use TLS MTU which is lower than DTLS MTU and DF bit set it cannot frag and the packet drop!!!
even if it not drop this need from the ASA frag each packet from Server go toward client and this so slow.
what we check here is :-
check the MTU client used is it
DTLS MTU or TLS MTU ..
waiting your reply
