Hello @fsebera ,
nice to see you again in the forums.
let us recap your findings:
>>
Extended ping sweep to remote end of GRE/IPSec tunnel df-bit set, mtu sizes 731-746 fail across WAN.
mtu sizes 64 - 730 work
mtu sizes 747 -1496 work
Same results from either side of the connection.
If I ping sweep my remote router physical interface with df-bit set, mtu sizes 64 - 1496 - results successful.
Our edge routers sub-interfaces have ip mtu 1496 set and the tunnel interface shows the ip mtu of 1476.
The end-results is our web applications fail.
Is there some reason -obvious or not -why pinging the non-tunnel address across the wan works while the tunnel addresses fail?
Communication across backup wan works.
>>>>>>>>
Extended ping sweep to remote end of GRE/IPSec tunnel df-bit set, mtu sizes 731-746 fail across WAN.
mtu sizes 64 - 730 work
mtu sizes 747 -1496 work
I have few questions for you Frank,
what exactly type of GRE over IPSec are you using ?
I mean we know GRE header is 24 bytes I can guess your WAN interface is a Vlan based subif because of ip mtu 1496 (4 bytes used by 802.1Q IEEE Vlan tag)
Do you use both AH and ESP ?
Are you in tunnel mode ?
what kind of HMAC and ESP encryption are you using ?
payload DF should be copied to outer GRE header and then it should be copied to the more external IPSec header if using AH.
@fsebera may you provide more details on your network environment in order to get better help ?
Ciao Frank Merry Xmas and Happy New Year
Hope to help
Giuseppe
