The problem with ICMP frag needed is some apps(read Microsoft) just
flat out fail when frag happens and set the DF bit to be sure it does
not. ICMP frag needed or not they will just fail over and over. They
may have gotten better with this since the last time I cared(somewhere
in between one and two years ago).
Increasing the MTU on core will not help if you can't raise the tunnel
MTU to match core interface minus encap overhead. You will still frag
on tunnel ingress.
I can see one of two possible ways to get around this, each with their
own caveats.
tcp mss-adj is one which obviously only useful for TCP connections.
The other caveat is that mss-adj will cause the first packet in each
direction to be punted to CPU so large number of session setup could
be an issue.
I can't remember the exact details as I only had 2nd hand involvement
in the MPLS MTU thing, they made a quick change which, for technical
implementation reasons, only lets you set MPLS MTU to MAX(like 9K or
44K or something huge). You could do this and assume that post
fragmentation is your best bet if you are using IPSEC and have IPSEC
platform that can handle the frag reassembly load which will then
cause everything to be reassembled before hitting the GRE / MPLS / app
layer. GRE and IPSEC take a performance hit with frag but this is
better than MPLS frag which is explicitly disallowed and not supported
in a number of specs and implementations.
Caveats and trade offs can be quite different from platform to
platform so I would recommend some validation testing whichever way
you decide to go.
-Ben
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
. . Benjamin Lovell
| | AS Video Practice
||| ||| Cisco Customer Advocacy
.|||||. .|||||. Research Triangle Park, NC
.:|||||||||:..:|||||||||:. Email: [email protected]
cisco desk:919.392.8255 cell:203.509.1562
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
On Sep 29, 2010, at 7:15 PM, Alasdair McWilliam wrote:
Thanks for the heads up on that.
My 'PE' routers will be 7200-NPE400 FE in/out or ASR1k GbE in/out
(and possibly ISR 3945s if/when the feature is available..) all with
standard 1500MTU. Inside LAN interfaces will be subinterfaces (one
per VRF) and outside WAN interfaces will be access ports running IGP
into IP core. Providing I can ensure ICMP Unreachables through the
client/server end to end path, I guess I should be OK. Would you
recommend setting anything like mss adjust on the inside sub-
interfaces if I can't? (Or as well as?!)
Do you (or anyone...) think there would be any noticeable
performance penalty (latency, throughput) with this scenario?
I have not yet investigated the possibility of simply increasing the
MTU on all my outside core interfaces but that is most likely out of
my control!
Any help/comments/suggestions appreciated! :-)
Cheers
Al
On 29 Sep 2010, at 21:40, Benjamin Lovell wrote:
If you are looking to do this for setting the MPLS MTU dynamically
then I don't think this will help as starting with our forwarding
infrastructure rewrite in 12.4(20)T (I would need to check to be
sure when/if in other code trains) we lost the ability to set the
MPLS MTU on tunnel interfaces.
See CSCth11646.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
. . Benjamin Lovell
| | AS Video Practice
||| ||| Cisco Customer Advocacy
.|||||. .|||||. Research Triangle Park, NC
.:|||||||||:..:|||||||||:. Email: [email protected]
cisco desk:919.392.8255 cell:203.509.1562
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
On Sep 29, 2010, at 3:17 PM, Alasdair McWilliam wrote:
Hi List,
Apologies if this is hidden in the list somewhere, but I've done a
bit of Googling and can't find too much.. so here goes!
I'm looking at implementing an MPLS VPN over mGRE solution to
facilitate routing instance segregation across multiple,
geographically separate sites, across a third party Layer 3
infrastructure. (12.2SRE for 7200, IOS-XE 3 for ASR1k and looks to
be coming into ISR G2 in 15.1T.) However given the mix of GRE
encapsulation to provide the PE-PE connectivity, I'm a bit worried
that apps might have a hissy fit.
My question is, does anyone know if it's possible to enable PMTUD
with this feature? I've got it setup in a lab and the Tunnel0 and
Tunnel1 interfaces cannot be directly modified from the CLI (they
don't appear in config either...)
The next best thing I can see would be Dynamic L3 VPNs over mGRE,
but that isn't available on the platforms I use, and I really
don't want to go as far as to enable full blown MPLS over point to
point GRE tunnels if I can at all avoid it!
Any tips? :-)
Cheers
Al
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
_______________________________________________
cisco-nsp mailing list [email protected]
https://puck.nether.net/mailman/listinfo/cisco-nsp
archive at http://puck.nether.net/pipermail/cisco-nsp/
