MTU Size DTLS 1.2

[gaigl]

Hello,

I've updatet our ASA to 9.10.1 and the anyconnect-client to 4.7.00136, now I receive a lot of messages: 

the connections are working and I don't see any drops, but it's annoying.

Does anyone know about this or what Vlue to set?

Received large packet 1406 (threshold 1390)

[Mohammed al Baqari]

Hi,

I am not sure if the default value changed in version 9.10 or you changed
it manually but the default MTU in earlier version is 1406 bytes.

Anyway the bigger MTU the better as long as you aren't hitting
fragmentation threshold and the VA will use the lower value between
physical NIC and ASA setting.

Do one thing, change the value on ASA CLI as below.

group-policy custom_group_policy attributes

webvpn

anyconnect mtu 1420

[gaigl]

Hi Mohammed,

that didn't change something, the MTU Size was the default of 1406, I've changed to 1420 and the messages still appear.

I think I need to change the treshold, or not?

[Mohammed al Baqari]

Apologize, I copied this from my notes without changing the value. It should be as

group-policy custom_group_policy attributes
webvpn
anyconnect mtu 1320

You can start from higher value and keep lower it until the message disappear. Other ways of changing it include changing MSS value which isn't something I prefer.

[monty.muth]

Doesn't work. ASA 9.10.1(7) anyconnect-client 4.7.00136 with DTLS 1.2. DPD is on default (30s/30s)

Received large packet 1336 (threshold 1320)

[ccubeman]

Can confirm. No mtu value will resolve the ‘large packet’ message with 9.10.1.7 and client 4.7.00136.

[Kidney]

Was this ever resolved?

I have this exact issue. No matter what I set the MTU to.. it's always 16 bytes too large.

[Kurena09]

It's probably a little late, but there is one bug that is responsible of those logs when the packets always exceed the threshold for 16 bytes:

https://bst.cloudapps.cisco.com/bugsearch/bug/CSCvp07143

"

When using AnyConnect 4.7.x (which supports DTLS v1.2) connecting to ASA 9.10.x/9.12.x, ....the ASA is replying to AnyConnect oMTU DPD packets with DPD responses of a different size (16 bytes larger than the DPD request).

The ASA responses are unexpected, as AnyConnect expects a DPD reply from the ASA to be the same size packet as sent by AnyConnect. This is specific to AES-GCM. AES-GCM is the default encryption for DTLS1.2."