Internet connectivity problem

[Harutyun Hakobyan]

Hi all,

From our branches I can't open some sites (e.g. yahoo.com, microsoft.com,...), but I can open google.com and others. Branch routers (Cisco 878) have IPsec site-to-site VPN with Head office which connects to internet. From Head office I can open all inetrnet sites.

IPsec Transform Set is 

crypto ipsec transform-set XXX esp-aes 256 esp-sha-hmac

inetrface tunnel X

ip mtu 1400

tunnel mode ipsec ipv4

I think that problem is related to current MTU size 1400.

In this document (page 16) I found that overhead for  "esp-aes-(256 or 192 or 128) esp-sha-hmac or md5" is 73, so I changed MTU to 1427 (1500-73) which didn't help.

So what size of MTU to use?

And if it isn't related to MTU size, what to do?

Thanks

[Jennifer Halim · Accepted solution]

You would need to configure: ip tcp adjust-mss 1340 (on your LAN interface)

So it will negotiate for a smaller MSS value so when it goes through the tunnel, it doesn't go over 1400/1427 MTU that you have configured.