VPN can't send packets larger than 1418 bytes

[benlemasurier]

Recently I've been having issues with our site to site vpn, certain connections will hang, I seem to have narrowed the problem down to the packet size:

ben:~$ ping -c 1 -s 1418 spino

PING spino (10.10.10.1) 1418(1446) bytes of data.

1426 bytes from spino (10.10.10.1): icmp_req=1 ttl=61 time=31.1 ms

1 packets transmitted, 1 received, 0% packet loss, time 0ms

rtt min/avg/max/mdev = 31.113/31.113/31.113/0.000 ms

ben:~$ ping -c 1 -s 1419 spino

PING spino (10.10.10.1) 1419(1447) bytes of data.

1 packets transmitted, 0 received, 100% packet loss, time 0ms

ben@tuberculosis:~$

So, a packet with a size of 1418 bytes goes through without any problems, but at 1419 bytes it fails! Any thoughts?

[fgoodwin]

Your problem is probably some where in the path to you VPN end points a device is not allowing packet fragmentation.

The link below explains the problem.

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a008081e621.shtml

The link gives a decent explanation and gives the info on how to calculate what each vpn type

will use as overhead on each packet.

[Mohamed Sobair]

Hi,

Your IPsec dosnt allow packet fragmentation,

Can you please try this command on the security appliance and let us know:

(crypto ipsec df-bit clear-df)

Regards,

Mohamed

[nareth_norung]

Dear Ben,

You can try to change IOS to ASA Version 7.2(4) !

Best Regards,

Norung