Solved

MTU problems with VPN

Posted on 2003-10-24
5
687 Views
Last Modified: 2012-06-22
Hi,

I want to connect two offices using VPN on Microsoft Windows 2000. The installation is not the problem; we had this set up and working in just a few hours.
However, when I connect to a POP3 server using a telnet client talking raw POP3 protocol I found that a packet is dropped silently when i send the LIST command. When there are a lot of messages in the inbox the response is not received.

I've tried a router-to-router solution without using VPN. The same problem occured with that solution. After hours and hours of debugging, reading and testing I found that the problem lies in the MTU. I made a few changes in the MTU settings and it worked! :)
The router-to-router solution is not encrypted. As soon as I add encryption OR use VPN the same problem happens again. I guess it is again the MTU, but this time I really can't figure it out.

Here is how the network looks like:

Internet -- InetGateway (192.168.1.100) -- Office1 (192.168.1.*) -- W2kGateway1 (192.168.1.1) --(WIFI Connection)-- W2kGateway2 (192.168.2.1) -- Office2 (192.168.2.*)

One more important thing: Both Windows 2000 gateways have 2 NIC's. One is configured and connected to the office LAN, the other is configured in a seperate subnet (10.0.0.*) and connected to the other gateway by a wireless connection.

Could anyone explain to me which adapter needs which MTU value? And what is "RAS MTU" and do I need to set this? (I found this option with DrTCP)

Help would really be appreciated, I can't figure it out ... Thanks in advance.
0
Comment
Question by:rschuil
  • 2
5 Comments
 
LVL 31

Accepted Solution

by:
qwaletee earned 250 total points
ID: 9614049
Usually, f the there are MTU problems due to a VPN, it will be n the internet traffic, not the internal traffic.  The VPN needs to take all your "regular" packets, encrypt them, and wrap them inside a new packet that is sent to the VPN server.  The VPN server then unwraps the packets, and retransmits them to the original IP address your application was trying to reach.  This typically results in the original packet eing broken up, because the original packet is too large to add all the VPN wrappering withou breakin the basic MTU limit.  The re-assembly effectively sends "fragmented packets," as if the packets had reached a router whose MTU was smaller than what you were sending.  Some VPNs are better than others at maintaining large packet caches, and reasembling the core packets as unfragmented units.

To ensre this does not happen at all, you have to drop your PC MTU to a size that is normal MTU minus maximum VPN per-packet overhead - which consists of teh ful size of a standard IP packet, plus encryption information.  Sometimes, you also have to do this on the internal servers, so that they will never send a frgamenting packet back to you; this is usually NOT a problem.

RAS MTU = Remote Access Services Maximum Transmission Unit, which is basically teh MTU for dial-up traffic.
0
 
LVL 31

Expert Comment

by:qwaletee
ID: 9614070
I woud start by changing your PC MTU to 1000, see if it works (very unlikely that your VPN would add 400+ bytes per packet).  If so, start bumping it up in 100 increments untl it fails again, then start splitting the difference.

If 1000 doesn't do it, then experiment with doing the same with the POP3 server you are trying to reach.
0
 

Assisted Solution

by:cue_man
cue_man earned 250 total points
ID: 11833188
0

Featured Post

Free Tool: IP Lookup

Get more info about an IP address or domain name, such as organization, abuse contacts and geolocation.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

How to set-up an On Demand, IPSec, Site to SIte, VPN from a Draytek Vigor Router to a Cyberoam UTM Appliance. A concise guide to the settings required on both devices
PRTG Network Monitor lets you monitor your bandwidth usage, so you know who is using up your bandwidth, and what they're using it for.
Internet Business Fax to Email Made Easy - With  eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, f…
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

840 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question