Hi Mohamed, thank you for your answers.
msobier123 wrote:
Hello Alen;
you wrote:
((( Please anyone, read my last post and answer the question. I just can not calm down till get an answer.
Answer,
Fragmentation is not desired and recommended , fragmentation could lead to performance degradation on a network , it also not required for certain security concern. Fragmentation cause high load on routers as well as if a detination doesnt recieve all the fragmented packet (fragmented packet get lost on the middle), the packet needs to be resended again.
Now, coming to your previous question, the best common methods as follows:
1- The Tunnel interface should be at least set to 1400 , the attribute is not arbitary, its devided as follows:
-- GRE Header = 4 Byte
-- IP Header = 20 Byte
-- TCP Header = 20 Byte
-- IPsec Header = 56 Byte
Total is 100 Byte substracting it from 1500 , as such the tunnel should be at least set with 1400.
2- The TCP maximum segment size MSS should be adjusted to 40 byte lower than than the 1400 byte of the GRE tunnel and should be set on the LAN segment.
Thank you, but I read the theory many times and everything is clear (except your minusing TCP header, I don't understand why should we minus TCP header when calculating MTU?).
The main thing: your settings seem quite reasonable. Thank you.
Do you think activation (in addition to your above mentioned 2 settings ) of PMTUD on both tunnel and LAN interfaces can make things worse?
IMHO, it should not. It will just allow in the future to even decrease the MTU if needed and if PMTUD works correctly, but will not make any problems for current settings even if PMTUD doesn't work correctly. Am I right?
The question is, if I have already activated both: globally configured PMTUD and tunnel PMTUD, should I disable them?
msobier123 wrote:
Coming to your 1st question:
1- The packet will first be encrypted and then Encapsulated with a GRE and then fragmented if it need fragmentation, so the order is Encryption > Encapsulation > Fragmentation.
Clear, thank you.
(But in Cisco's Resolve IP Fragmentation, MTU, MSS, PMTUD Issues with GRE and IPSEC.pdf it was an example (scenario 10) where the order was fragmentation / encapsulation / encryption!? Why?)
msobier123 wrote:
2- You dont need this command, if the ICMP packet is too big, icmp packet will be fragmented if the Dont fragment bit is not set on the router. if the router for any reason has DF bit set, an icmp (destination host unreachable) message will be sent to the original host dictating packet needs to be fragmented but DF is set.
Well, this is clear, but first an intermediary router should send an ICMP packet to my router (as it is the starting point of tunnel and new, incapsulated packet source is his external interface ip). And my router will not "receive" it as it will be blocked by the ACL on ext. interface: block all, except ISAKMP, ESP and ICMP with source ip of another tunnel end router's ext. interface ip.
So I need to add the entry, if I want unreachables about "fragmentation needed" from intermediary routers to be passed and processed. Don't I?
msobier123 wrote:
3- Yes, it will do the same function and will set the DF bit on the icmp.
Thank you. This was very important question, as I was not sure I can get real MTU when testing through the IPSec encrypted GRE tunnel.
No, I know I can find max path MTU just by pinging with -f option from one LAN host - another LAN host!
msobier123 wrote:
4- you can either have IPsec tunnel profile or IPsec Crypto map based on your IPsec configuration.
I see this on my spokes:
crypto isakmp policy 1
encr aes 256
authentication pre-share
group 2
crypto isakmp key 6 xxx address 0.0.0.0 0.0.0.0
crypto isakmp invalid-spi-recovery
crypto isakmp keepalive 10 periodic
!
!
crypto ipsec transform-set dmvpnset esp-aes 256 esp-sha-hmac
!
crypto ipsec profile dmvpnprof
set transform-set dmvpnset
And I don't see anything that contains "ipsec tunnel" phrase.
=> As I understand I have IPSec in transport mode, which is "better" in case we are making encapsulation using GRE. Am I correct?
And MTU should be: 1500 - 24 (GRE) - 38 (max for IPSec transport mode) - 8 (for DSL) = 1430?
And this is in case line providers are not using any other encapsulations?
P.S. I'll rate your post later, I am not still satisfied and don't want the question to be marked as answered.
