We use dmvpn to an enormous scale over wired/broadband/wireless internet access for various business lines/uses. SSL/TLS cannot be fragmented so any application with large payload segments using SSL/TLS will have issues over GRE IPSEC tunnels. Outlined below are the necessary steps for large packets to traverse the VPN without issues.
1) TCP - On the tunnel interface, reduce the MTU and MSS to the Cisco best practice configuration for GRE/IPSEC
interface Tunnel10
ip mtu 1400
ip tcp adjust-mss 1360
We have found that some wireless networks use tunneled backhauls which further reduce MTU, so we have reduced both values by -40 bytes to accommodate as follows.
interface Tunnel10
ip mtu 1360
ip tcp adjust-mss 1320
2) The above configuration does nothing for UDP, because it has no way to adjust mss. Some tftp clients will use very large payload segments. We use a route map on the Ingress interface to clear the DF bit on UDP packets so fragmentation will occur.
interface Vlan10
ip policy route-map FRAG-UDP-rmap
!
ip access-list extended FRAG-UDP
permit udp any any
!
route-map FRAG-UDP-rmap permit 10
match ip address FRAG-UDP
set ip df 0
!
route-map FRAG-UDP-rmap deny 99
There is no implicit deny at the end of a Cisco route-map, so the explicit deny is necessary to prevent matching all traffic, not completely necessary here, but a best practice.
3) ICMP - The only reason ICMP packets should be large is for testing. You can accomplish this with the following lines.
ip access-list extended FRAG-UDP
permit icmp any any
4) You must configure these elements on both ends of the tunnels.
We have used these configurations globally without issues.
Thanks,
Brian
