Solved

MTU problems with VPN

Posted on 2003-10-24
5
682 Views
Last Modified: 2012-06-22
Hi,

I want to connect two offices using VPN on Microsoft Windows 2000. The installation is not the problem; we had this set up and working in just a few hours.
However, when I connect to a POP3 server using a telnet client talking raw POP3 protocol I found that a packet is dropped silently when i send the LIST command. When there are a lot of messages in the inbox the response is not received.

I've tried a router-to-router solution without using VPN. The same problem occured with that solution. After hours and hours of debugging, reading and testing I found that the problem lies in the MTU. I made a few changes in the MTU settings and it worked! :)
The router-to-router solution is not encrypted. As soon as I add encryption OR use VPN the same problem happens again. I guess it is again the MTU, but this time I really can't figure it out.

Here is how the network looks like:

Internet -- InetGateway (192.168.1.100) -- Office1 (192.168.1.*) -- W2kGateway1 (192.168.1.1) --(WIFI Connection)-- W2kGateway2 (192.168.2.1) -- Office2 (192.168.2.*)

One more important thing: Both Windows 2000 gateways have 2 NIC's. One is configured and connected to the office LAN, the other is configured in a seperate subnet (10.0.0.*) and connected to the other gateway by a wireless connection.

Could anyone explain to me which adapter needs which MTU value? And what is "RAS MTU" and do I need to set this? (I found this option with DrTCP)

Help would really be appreciated, I can't figure it out ... Thanks in advance.
0
Comment
Question by:rschuil
  • 2
5 Comments
 
LVL 31

Accepted Solution

by:
qwaletee earned 250 total points
ID: 9614049
Usually, f the there are MTU problems due to a VPN, it will be n the internet traffic, not the internal traffic.  The VPN needs to take all your "regular" packets, encrypt them, and wrap them inside a new packet that is sent to the VPN server.  The VPN server then unwraps the packets, and retransmits them to the original IP address your application was trying to reach.  This typically results in the original packet eing broken up, because the original packet is too large to add all the VPN wrappering withou breakin the basic MTU limit.  The re-assembly effectively sends "fragmented packets," as if the packets had reached a router whose MTU was smaller than what you were sending.  Some VPNs are better than others at maintaining large packet caches, and reasembling the core packets as unfragmented units.

To ensre this does not happen at all, you have to drop your PC MTU to a size that is normal MTU minus maximum VPN per-packet overhead - which consists of teh ful size of a standard IP packet, plus encryption information.  Sometimes, you also have to do this on the internal servers, so that they will never send a frgamenting packet back to you; this is usually NOT a problem.

RAS MTU = Remote Access Services Maximum Transmission Unit, which is basically teh MTU for dial-up traffic.
0
 
LVL 31

Expert Comment

by:qwaletee
ID: 9614070
I woud start by changing your PC MTU to 1000, see if it works (very unlikely that your VPN would add 400+ bytes per packet).  If so, start bumping it up in 100 increments untl it fails again, then start splitting the difference.

If 1000 doesn't do it, then experiment with doing the same with the POP3 server you are trying to reach.
0
 

Assisted Solution

by:cue_man
cue_man earned 250 total points
ID: 11833188
0

Featured Post

What Is Threat Intelligence?

Threat intelligence is often discussed, but rarely understood. Starting with a precise definition, along with clear business goals, is essential.

Join & Write a Comment

Short answer to this question: there is no effective WiFi manager in iOS devices as seen in Windows WiFi or Macbook OSx WiFi management, but this article will try and provide some amicable solutions to better suite your needs.
Even if you have implemented a Mobile Device Management solution company wide, it is a good idea to make sure you are taking into account all of the major risks to your electronic protected health information (ePHI).
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

758 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

24 Experts available now in Live!

Get 1:1 Help Now