Cisco 1800 - MTU Issue

[mistryj]

Hello,

We are upgrading the Internet at one of our sites , the ISP has provided a separate router and ONT to connect.

When connecting to new ISP router the Internet works fines but our Site-to-Site via Nortel VPN connection fails. 

Production Switch--------->Nortel VPN-------->Cisco 1800------->ISP Router------------->Internet

I have been asked to set the MTU on the external interface on our equipment (Cisco 1800) by the ISP to MTU 1440.

The Nortel VPN operates at MTU 1788.

Cisco 1800 - image - c1841-advsecurityk9-mz.124-3c.bin

1) Do I apply ' ip mtu 1440 ' on fast ethernet interface.    Do I need anything else ?

2) Also is this likely to cause issues with Nortel VPN device operating at 1788 ?

Please advise asap ?

Jay

[Peter Paluch]

Hello,

Yes, on the interface towards the ISP router, use the ip mtu 1440 command. It is also recommended that you use the ip tcp adjust-mss 1400 command on all other physical interfaces of your router to make it decrease the maximum negotiated segment size of TCP segments passing through your router to 1400 bytes, thereby preventing the need to fragment the packets. The TCP header is 20 bytes long, so when considering the IP header to be also 20 bytes, the resulting maximum body of a TCP segment is in your case 1440-20-20=1400 bytes.

Lowering the IP MTU may cause issues if an application, such as your Nortel, is sending larger IP packets with the DF (Don't Fragment) flag set. In such case, the router is prohibited from fragmenting an IP packet that is over 1440 bytes, and will be forced to drop it. Usually, this can be discovered by interactive sessions like instant messaging, telnet/ssh or similar working fine while larger downloads utilizing full packet length are exceedingly slow or actually not working at all.

Why does your ISP actually ask you to lower the MTU to 1440, and why is the Nortel VPN using such unusual MTU of 1788 bytes? Is your ISP also providing any VPN service for you, either VPN, DMVPN, IPsec or similar?

Best regards,

Peter

[mistryj]

Hi Peter,

The ISP is an UAE provider.  Its difficult to get any information from them.  They are only providing Internet service only.

All they said was they have enabled the VPN protocols we requested and they recommended we set the MTU to 1440 for ip fragmentation.

The Nortel VPN is a managed VPN service by another provider.   This initiates the site-to-site vpn tunnels between all offices.

I am not sure why the MTU is set to 1788,  this is what they told me and what is being used on all our Nortel VPN devices we have in all offices.

All inter-office traffic i.e email , docs etc.. will be via VPN however internet traffic will routed directly out of ISP router.

This is the first fibre network we are connecting to and I guess they are reluctant to make any changes to their network.

Is it worth changing the MTU if its still going to cause problems ?  

or shall I persist and getting them to set the standard MTU on their network ?

Thanks,

Jay

[Peter Paluch]

Hello Jay,

Let's go over some of the information you have provided.

All they said was they have enabled the VPN protocols we requested and 
they recommended we set the MTU to 1440 for ip fragmentation.

It is necessary to interpret this statement properly. It could mean two different things:

• Either that the ISP router will not accept packets larger than 1440 bytes
• Or that the ISP router will accept normally sized packets up to 1500 bytes and they only suggested lowering the MTU, knowing you are about to deploy a VPN, so that some of your devices do not need to perform fragmentation because of the added overhead

Is it worth changing the MTU if its still going to cause problems ?   
or shall I persist and getting them to set the standard MTU on their network ?

I do not think you could actually persuade them to change their MTU settings across the network. The primary question is whether the MTU of 1440 bytes is their recommendation for your devices, or whether it is the upper size limit of a packet on the link between your router and the ISP router, as I indicated earlier.

If their router is actually fine with 1500 byte packets then you do not have to modify anything because your 1800 router will be performing the fragmentation to 1500 bytes if necessary (the MTU of 1500 is the default). If, on the other hand, the ISP's MTU setting is 1440 bytes then you must change your settings on the 1800 router as well, otherwise packets larger than 1440 bytes would be dropped by the ISP.

I suggest starting by better understanding of the requirement-or-recommendation of your ISP about the MTU of 1440 bytes. Can you talk to them and ask for more precise explanation?

Best regards,

Peter

[mistryj]

Hello Peter,

This issue has now been resolved.

After serveral emails over the weekend , managed to finally get ISP to keep the standard MTU configuration.

The VPN was still not coming up but this was due to a routing issue with Cisco 1800.

Cisco had a default route pointing to external interface FE0/0 and the route had to be changed to point to ip address on external interface connecting ISP router.  This is a point to point ip address /32    (.239 - ISP and .230 Cisco1800).

>> ip route 0.0.0.0 0.0.0.0 FastEthernet0/0   - This statement works with original ISP router but not the new Router.

interface FastEthernet0/0
description connected to Internet
ip address x.x.x.230 255.255.255.252
duplex auto
speed auto
!
interface FastEthernet0/1
description connected to LAN
ip address x.x.x.x 255.255.255.240
duplex auto
speed auto
!
ip classless

ip route 0.0.0.0 0.0.0.0 x.x.x.229  - VPN works with this static route.
!

Not sure what the difference is any ideas ?

Jay

[paolo bevilacqua]

>> ip route 0.0.0.0 0.0.0.0 FastEthernet0/0   - This statement works with original ISP router but not the new Router.

Because the other ISP was supporting proxy-arp, but the new one (correctly) doesn't.

Never point routes at LAN interfaces. Always use IP address.

[mistryj]

Ok now I understand Thank you !

Thank you both for your replies very helpful.