Ping1500 size

[CCIE Aspirant]

Hi all,

we have our remote office where we have cisco . The router is having IPsec tunnel to our main head office. All the traffic from the remote office is forwarded through the tunnel to head office router. 

Our Problem is that we can not ping google with size 1500 from the remote office the maximum size is 1000. 

Kindly needs solution for this matter.

[Joseph W. Doherty]

Issue sounds normal, in that tunnels decrease effective IP MTU due to tunnel overhead (especially IPSec).

Two "solutions" that come to mind.

First, if media supports jumbo Ethernet, than your (mGRE/IPSec) tunnel packets can support "classical" max size Ethernet MTU.

Second, have router "lie" to client.  I.e. have router reset DF bit and transmit fragmented packet.

[CCIE Aspirant]

thanks for the reply

Media at remote side is LTE sim.

****Second, have router "lie" to client.  I.e. have router reset DF bit and transmit fragmented packet****

can u please elaborate the above statement please.

[Joseph W. Doherty]

https://www.cisco.com/c/en/us/support/docs/ip/generic-routing-encapsulation-gre/25885-pmtud-ipfrag.html#anc9

Search for "clear".

[MHM Cisco World]

ip mtu 1398 in head Office <- this effect the total all MTU

ip mtg 1365 in remote "include two IP header one GRE and other is IPSec if you config tunnel mode, here can you try transport mode instead and save 24 bytes".

[Richard Burts]

Issues with MTU are common when sending traffic over an IPSec tunnel. tcp adjust-mss is usually quite effective in this situation. But it is limited to tcp traffic. I would expect that web browsing and other tcp based applications should work pretty well. But it does not do anything for ping and other non-tcp traffic.

I see that you are setting ip mtu on the tunnel interfaces. Are you also doing that on the outbound interface that carries the tunnel traffic?

[CCIE Aspirant]

Thanks for the reply 

from remote office we can have ping to our HQ router with 1500 size. But when we try to ping google dns, then we can not do more then 1000bytes. 

[CCIE Aspirant]

thanks for the reply

so what size should I pick at HO router so that we can might reach somewhere near to 1500 size ping ?

I have tried many values but can not get more then 1000 bytes response ping.

[MHM Cisco World]

Hi, 
what is router you use in remote site ?
can you ping HQ with 1360 ??