Hello Cristian Matei,   thank you for this Link. That gives a good overview. However, I still don't get it what is wrong in my setup as the Virtual Tunnel still has not the MTU that it should have :-(   router#sh int virtual-access 12 Virtual-Access12 is up, line protocol is up Hardware is Virtual Access interface Interface is unnumbered. Using address of GigabitEthernet0/0 (1.2.3.4) MTU 17862 bytes, BW 100 Kbit/sec, DLY 50000 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation TUNNEL Tunnel vaccess, cloned from Virtual-Template2 Vaccess status 0x4, loopback not set Keepalive not set Tunnel linestate evaluation up Tunnel source 1.2.3.4, destination 5.6.7.8 Tunnel protocol/transport IPSEC/IP Tunnel TTL 255 Tunnel transport MTU 1422 bytes Tunnel transmit bandwidth 8000 (kbps) Tunnel receive bandwidth 8000 (kbps) Tunnel protection via IPSec (profile "ipsec-profile_AnyConnect") Last input never, output never, output hang never Last clearing of "show interface" counters 14:18:29 Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/0 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec 274327 packets input, 62501835 bytes, 0 no buffer Received 0 broadcasts (0 IP multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 295410 packets output, 198153680 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 unknown protocol drops 0 output buffer failures, 0 output buffers swapped out   In your link they are talking about "AnyConnect VA gets its MTU value from SSL Server (ASA or IOS. We will focus more on ASA). The default value is 1406-bytes...". So the question is still open how I can set the MTU on the Windows client VA via Router settings? Or is the only solution to run a script on the windows machine?  Sorry that I have to ask twice, as I am not the crypto expert :-/   René ... View more

Hello,   yes, using FlexVPN. I did  a change to the virtual-template, but it did not change the MTU on my client, as it is still 1406 after connecting to the router.   This is what I setup:   interface Virtual-Template2 type tunnel ip unnumbered GigabitEthernet0/0 ip mtu 1400 ip tcp adjust-mss 1352 tunnel mode ipsec ipv4 tunnel protection ipsec profile ipsec-profile_AnyConnect And this is the sh interface:   Virtual-Template2 is up, line protocol is down Hardware is Virtual Template interface Interface is unnumbered. Using address of GigabitEthernet0/0 (41.164.55.132) MTU 17940 bytes, BW 100 Kbit/sec, DLY 50000 usec, reliability 255/255, txload 1/255, rxload 1/255 Encapsulation TUNNEL, loopback not set Keepalive not set Tunnel linestate evaluation down - no IPv4 tunnel destination address Tunnel source UNKNOWN Tunnel protocol/transport IPSEC/IP Tunnel TTL 255 Tunnel transport MTU 1500 bytes Tunnel transmit bandwidth 8000 (kbps) Tunnel receive bandwidth 8000 (kbps) Tunnel protection via IPSec (profile "ipsec-profile_AnyConnect") Last input never, output never, output hang never Last clearing of "show interface" counters 18w0d Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 0 Queueing strategy: fifo Output queue: 0/0 (size/max) 5 minute input rate 0 bits/sec, 0 packets/sec 5 minute output rate 0 bits/sec, 0 packets/sec 0 packets input, 0 bytes, 0 no buffer Received 0 broadcasts (0 IP multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 0 packets output, 0 bytes, 0 underruns 0 output errors, 0 collisions, 0 interface resets 0 unknown protocol drops 0 output buffer failures, 0 output buffers swapped out I am confused that the interface shows 1500 bytes for the tunnel mtu.   any other idea? ... View more

Hello Scott, just to be sure, with "username" you mean the "hostname" field as there is a username and a hostname field? I am talking about the hostname field. It is strange to see that two of three iOS Devices with the same Version release are showing up hostname field and one does not :-( ... View more

Is it possible to pass vpn traffic to the second vpn router although these kind of protocols are used on the first router? Like if I pass vpn traffic which comes in on the second IP address of the same outside Interface. And all other VPN Traffic which comes in on the first IP will be terminated and used on the first router.   Example: When I try to setup an "ip nat inside source static 192.168.1.1 22 9.9.9.9 22" it says that the Port 22 is being used by system. In this example IP 9.9.9.9 is the secondary public IP. ... View more

the other Router is not a Cisco Router. And I need to forward all kind of traffic which comes in on this specific second IP, not only VPN traffic? Is there an option?  ... View more

Hi,   is it a must to setup a portchannel on the Nexus or can I simply configure the ports on both Nexus Switches as Trunk Port? I guess I need the vpc xx command within the port-channel to get it work correctly?! ... View more

Hi, we are facing this issue on a WS-C4506-E Switch with SUP v8 installed. Our current IOS version is 152-2.E6. I think I have to open a TAC case for that :-( ... View more