Applications over VPN

[jerrykenny16]

I currently have a Cisco 3725 IOS 12.3 at my headquarters, and a 1760 at my field office. I am using GRE tunnel with EIGRP enabled. The tunnel is up and I can ping and trace route to every device on my network. However I cannot get applications to work across the tunnel (like Microsoft Outlook). Any suggestions? thanks

[ehirsel]

Can you post both router configs, scrubbing any sensitive info?

What is the wan/man topology used to connect the 1760 the the 3725 - i.e., frame relay, dsl?

Are you using IPSec as well as GRE?

It could be a path mtu issue, mainly if the routers do not generate icmp unreachable messages. GRE adds 24 bytes of protocol overhead meaning that the effective mtu as far as the workstation is concerned is 1476, instead of 1500 bytes. If IPSec is used then up to 60bytes more overhead is used, or 80 depending upon ipsec transport (no new ip header) or tunnel mode (new ip header) use.

[jerrykenny16]

We are using IPSec and GRE.

Wan Topology - 3725 T1 - 1760 Cable

I've attached to configs

Thanks alot

[Richard Burts]

If you have successful IP connectivity between all devices as demonstrated by successful ping and trace between all devices and applications do not run, then my first guess is a problem with MTU.

I see in the 1760 config that you are setting ip mtu on the tunnel to 1420 which should help address this issue. But in my experience it is sometimes not enough. So here are several observations and suggestions.

I notice that you have no ip unreachables configured on the tunnel. No unreachables will break Path MTU discovery. So my first suggestion is to turn on unreachables.

I see that you have configured mtu path discovery. But with no unreachables configured, I am not sure that it can work. So ditto the suggestion in the paragraph above about turn on unreachables.

I see that you are setting ip mtu to 1420. I have a customer who is doing EIGRP and IPSec/GRE tunnels. We found that 1420 was not small enough. With the combination of IPSec/ESP/GRE we experimented and found that 1370 solved our problem.

At that customer I had good experience using the ip tcp adjust-mss command as a way to solve the MTU issue. It is documented to work on physical interfaces (which is where we applied it) and I have heard some discussion that it may also work on the tunnel interface.

Try some or all of these and let me know if it helps.

[jerrykenny16]

The IP unreachables did the trick. Thanks a lot I really appreciate it.