MTU on VPN 3030 Public interface

[tech]

I have a few instances with the Cisco VPN client when the MTU has to be lowered. I have had users ping with the -f and -l option to determine the largest packet size that can traverse the VPN. I have a question on the most efficient method.

If the largest packet size is 1200 that replies from the ping test, should I set the MTU on the Publice interface of the VPN 3030 to 1242? Also, set the MTU on each client to Custom --> 1242 bytes?

I also have the default Public Fragmentation Policy on the VPN 3030. "Do not fragment prior to IPSec encapsulation; fragment prior to interface transmission"

Would this work best in most cases?

Thanks,

RJ

[shijogeorge]

Hi,

The MTU settings has to be changes at the client end only, not at the Concentrator end.

And I would suggest to go in for the Fragmentation policy "Fragment prior to IPSec encapsulation without Path MTU Discovery (Clear DF bit)" as this could avoid sending fragmented IP packets and this works fine in situations where ICMP is blocked also.

Regards,

Shijo George.