MTU on outside Interface

[f-cagica]

Hello experts,

i have a strange issue on a link between two ASA5510: both ASAs are interconnected by a P2P Fastethernet link, and the traffic between both ASAs is being secured by a L2L IPsec tunnel. The configured MTUs are 1500, however packets bigger than 1020byte are being dropped. IOS is 8.0(5). I didn't find so far any CAVEAT describing it. Does anyone know about this issue?

Thank you

Fernando

[Richard Burts]

Fernando

It is a pretty well recognized issue that when you run traffic through an IPSec VPN that the VPN processing adds additional encapsulation to the frame. If the original data packet was 1500 bytes and then we run it through the IPSec encryption process the result is a frame that is larger than 1500 and it causes problems.

You can try to control the traffic to keep the MTU smaller or you can try to clear the DF bit so that the frames can be fragmented.

HTH

Rick

[f-cagica]

Rick,

we are talking about a difference of 380Bytes OH... As far as i know with IPsec i can expect like 56-60Bytes extra OH. Now, from the peer FW i can't run a ping vetween both Outside interfaces with more than 1020Bytes. The ping is not encapsulated and the DF bit is not set.

Br,

Fernando