Noted with thanks. Best regards,
-nick/ Masood Ahmad Shah wrote: > Please always CC to mailing list so others can see it and share their > experience/thoughts.... > > > > Regards, > Masood Ahmad Shah > > > -----Original Message----- > From: Nick Kraal [mailto:[EMAIL PROTECTED] > Sent: Friday, September 21, 2007 10:54 PM > To: Masood Ahmad Shah > Subject: Re: [c-nsp] MTU settings/GRE tunnel > > Thanks Masood for the advice. We got stuck bing time accessing some internal > web servers. Narrowed this down to MTU/MSS issues. Adjusting the MSS helped > out a lot. Will try the other pointers given. > > Much appreciated and regards, > > -nick/ > > Masood Ahmad Shah wrote: >> use 'ip tcp adjust-mss 1400' on a router seeing traffic in the clear >> to force MSS to 1400 so IP datagram size to 1420 (of course 1400 is >> just a guess), this will cover all TCP traffic. >> >> Set ip mtu 1500 on GRE tunnel interface (yes 1500 bytes).. >> >> Reasoning: >> - - GRE encapsulation clears the DF bit UNLESS 'tunnel path-mtu-discovery' >> is set on the tunnel interface (if turned on the tunnel MTU will be >> dynamically adjusted upon receipt of ICMP) >> - - IPsec encapsulation copies the DF and adjusts the path MTU upon >> receipt of ICMP UNLESS 'crypto ipsec df-bit clear/set' is configured >> in the crypto map >> - - router will fragment when forwarding to any interface whose MTU is >> smaller than the received IP packet. This happens often when >> forwarding to a GRE tunnel whose MTU is 1476 per default... >> >> >> The last point forces the router to drop all 1500-bytes packets and to >> send an ICMP message when a DF packet is received. >> >> >> Regards, >> Masood Ahmad Shah >> >> >> -----Original Message----- >> From: [EMAIL PROTECTED] >> [mailto:[EMAIL PROTECTED] On Behalf Of Nick Kraal >> Sent: Thursday, September 20, 2007 12:51 PM >> To: [email protected] >> Subject: [c-nsp] MTU settings/GRE tunnel >> >> Dear all, >> >> We are setting up tunnels within our network, and are using some >> previous documented configurations for this. We will use this to >> enable virtual P2P BGP sessions to isolate certain parts of our routing > table. >> Cheap, temporary, and fast. >> >> interface Tunnel0 >> ip address 192.168.100.9 255.255.255.252 >> no ip unreachables >> no ip proxy-arp >> ip mtu 1524 >> tunnel source Loopback1 >> tunnel destination 10.10.10.10 >> >> Is there any information/advice/rule-of-thumb on setting the MTU size >> on the tunnel interface? >> >> Thanks in advance, >> >> -nick/ >> _______________________________________________ >> cisco-nsp mailing list [email protected] >> https://puck.nether.net/mailman/listinfo/cisco-nsp >> archive at http://puck.nether.net/pipermail/cisco-nsp/ >> >> _______________________________________________ >> cisco-nsp mailing list [email protected] >> https://puck.nether.net/mailman/listinfo/cisco-nsp >> archive at http://puck.nether.net/pipermail/cisco-nsp/ > > _______________________________________________ > cisco-nsp mailing list [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
