Please always CC to mailing list so others can see it and share their experience/thoughts....
Regards, Masood Ahmad Shah -----Original Message----- From: Nick Kraal [mailto:[EMAIL PROTECTED] Sent: Friday, September 21, 2007 10:54 PM To: Masood Ahmad Shah Subject: Re: [c-nsp] MTU settings/GRE tunnel Thanks Masood for the advice. We got stuck bing time accessing some internal web servers. Narrowed this down to MTU/MSS issues. Adjusting the MSS helped out a lot. Will try the other pointers given. Much appreciated and regards, -nick/ Masood Ahmad Shah wrote: > use 'ip tcp adjust-mss 1400' on a router seeing traffic in the clear > to force MSS to 1400 so IP datagram size to 1420 (of course 1400 is > just a guess), this will cover all TCP traffic. > > Set ip mtu 1500 on GRE tunnel interface (yes 1500 bytes).. > > Reasoning: > - - GRE encapsulation clears the DF bit UNLESS 'tunnel path-mtu-discovery' > is set on the tunnel interface (if turned on the tunnel MTU will be > dynamically adjusted upon receipt of ICMP) > - - IPsec encapsulation copies the DF and adjusts the path MTU upon > receipt of ICMP UNLESS 'crypto ipsec df-bit clear/set' is configured > in the crypto map > - - router will fragment when forwarding to any interface whose MTU is > smaller than the received IP packet. This happens often when > forwarding to a GRE tunnel whose MTU is 1476 per default... > > > The last point forces the router to drop all 1500-bytes packets and to > send an ICMP message when a DF packet is received. > > > Regards, > Masood Ahmad Shah > > > -----Original Message----- > From: [EMAIL PROTECTED] > [mailto:[EMAIL PROTECTED] On Behalf Of Nick Kraal > Sent: Thursday, September 20, 2007 12:51 PM > To: [email protected] > Subject: [c-nsp] MTU settings/GRE tunnel > > Dear all, > > We are setting up tunnels within our network, and are using some > previous documented configurations for this. We will use this to > enable virtual P2P BGP sessions to isolate certain parts of our routing table. > Cheap, temporary, and fast. > > interface Tunnel0 > ip address 192.168.100.9 255.255.255.252 > no ip unreachables > no ip proxy-arp > ip mtu 1524 > tunnel source Loopback1 > tunnel destination 10.10.10.10 > > Is there any information/advice/rule-of-thumb on setting the MTU size > on the tunnel interface? > > Thanks in advance, > > -nick/ > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ > > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
