Cisco VPN MTU Issues

[goulin1]

Hi,

I am having issues with bringing up Cisco VPN sessions and I am sure that it is an MTU issue.

We have successfully been using IPSec over UDP to a VPN Concentrator which has a DSL Internet connection, and it has been working over all types of connections (including DSL).

We are now looking at using IPSec over TCP, using the same VPN Concentrator and DSL connection. It seems to work fine with users from cable/Ethernet type Internet connections, but doesn't work with users on DSL type connections.

I tried setting the users MTU on the DSL modem to 1200 bytes and used the Set MTU utility to set the MTU to 576 but half of our applications won't work. When we were using 1300 bytes on the modem and 1200 on the client, nothing would work.

Is there an ideal setting for the MTU for DSL connections? I tried a various combinations of MTUs but no luck.

Also, I got the following syslog message which is related:

6|Mar 07 2007 11:39:42|602101: PMTU-D packet 1420 bytes greater than effective mtu 1362, dest_addr=10.19.201.44, src_addr=172.19.88.40, prot=TCP

Hopefully someone has the answer.

Thanks,
goulin1

 

[boymarty24]

I have had alot of problems with mtu on ciscos 870/1800 series. I have used the ping command to determine what mtu to use. Never had the problem with pix/asa and the only concentrator i have configured.

ping -l -f "mtu size" "ip"

The f shows fragment information

 

[NetworkGhost]

May want to try clearing the DF Bit so the packet can be fragmented. Some applications may have it set.

crypto ipsec df-bit clear-df outside

Free Firewall/Network/Systems Support-

http://firewalls.ath.cx

 

[NetworkGhost]

I have also heard that 1442 is a good MTU Size for DSL users when using IPSEC.

Free Firewall/Network/Systems Support-

http://firewalls.ath.cx

 

[goulin1]

NetworkGhost,

Thanks for the advice - the 'crypto ipsec df-bit clear-df' works perfectly. The funny thing was that the VPN hosts could access half the servers but not the other half - stupid Windows servers, probably wouldn't have happened if we used Unix.