[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

Site To Site VPN, MTU

Posted on 2007-10-11
12
Medium Priority
?
2,227 Views
Last Modified: 2013-06-15
I have a site to site vpn set up from a Netgear to a cisco router. THe vpn is stable, i can ping, ftp, telnet, rdp, etc down the tunnel.

I have a NAS device at one end which i would like to be able to copy NFS shares to overnight, However they wont copy. The file writes to the disk then hangs and lists the share as 0 bytes.

I can transfer from Windows to NAS and back the other way, however the speed is not great. I  can also tranfer from window sto windows.

I can browse the NFS shares on the NAS from the linux box but i cant transfer data.

The MTU is set to 1500 on both lans. I can ping with MTU of 1472 from windows to linux at one side hovever not back the other way.

When i ping windows to windows, or windows to NAS/NFS with 1473 i get the reply i would expect

"packet needs to be fragmented but DF set"

However when i drop the packet size to 1472, the ping request times out. This is the same to 1416. It is not untill 1415 that i get a ping response.

I am confused as to why this would happen? could this be casusing my problems due to fragemented packets? Would lowering the MTU fix this problem

thanks in adavance
0
Comment
Question by:Paul-Brooks
  • 5
  • 3
  • 2
  • +1
12 Comments
 
LVL 30

Expert Comment

by:Kerem ERSOY
ID: 20061918
Hi,

As you told this is definitely a packet fragmentation issue. So you need to tune down your VPN just to allow you to access your NAS device. NAS devices generally set packet size in the range 16-32K to gain performance this might be the issue as well. So I'll suggest you to read the related sections from your NAS configuration administrator guide and set the MTU accordingly for NASs device too.
0
 
LVL 6

Accepted Solution

by:
Galtar99 earned 750 total points
ID: 20061936
0
 
LVL 2

Expert Comment

by:ajcaruso00
ID: 20062651
Typically an MTU of 1350 works for me.


As far as setting the MTU to 1500 and then sending a 1415 ICMP through the tunnel, you have to remember that the IPSec happens before the MTU check.  IPSec adds about (well, I I take your word on the packet sizes 75 bytes :-) to the header.  And, an IPSec packet post encrypting cannot be fragg'd hence DF.

Hope that helps. -T
0
Free learning courses: Active Directory Deep Dive

Get a firm grasp on your IT environment when you learn Active Directory best practices with Veeam! Watch all, or choose any amount, of this three-part webinar series to improve your skills. From the basics to virtualization and backup, we got you covered.

 

Author Comment

by:Paul-Brooks
ID: 20063966
that would make sence, so i add the commands to the dialer0 interface?
0
 
LVL 2

Expert Comment

by:ajcaruso00
ID: 20065458
I haven't seen your config, but I would think dialer0 to be the outside internet-facing interface.  You want to control the MTU before the packet gets to the inside interface (the LAN side) so put it there (on both devices).

-T
0
 
LVL 6

Expert Comment

by:Galtar99
ID: 20067640
With a 1500 byte MTU the largest unfragmented ping is 1472 because you have a 28 byte IP header and a 8 byte ICMP header.
0
 

Author Comment

by:Paul-Brooks
ID: 20073856
i have the folling config for dialer0

interface Dialer0
 ip address negotiated
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat outside
 ip virtual-reassembly
 encapsulation ppp
 ip route-cache flow
 dialer pool 1
 dialer-group 1
 no cdp enable
 ppp authentication chap pap callin
 ppp chap hostname xxxxxxxx
 ppp chap password xxxxxxxxxxxxx
 ppp pap sent-username xxxxxxxxx
password xxxxxxxxxxx
 crypto map SDM_CMAP_1

when i try to change the MTU settings the VPN drops. I asumme this is due to the cpnfig needing to be changed at the netgear end. HOweag the netgear vpn is basic, is is posisible to change the MTU settings for this?

0
 
LVL 30

Assisted Solution

by:Kerem ERSOY
Kerem ERSOY earned 750 total points
ID: 20073895
You might want to try:
conf term
int Dialer0
ppp mtu <mtu_value>

then you'd retry dialing.
0
 

Author Comment

by:Paul-Brooks
ID: 20074399
will try it but what do i need to do to change the Netgear end? or does that not matter?
0
 
LVL 30

Expert Comment

by:Kerem ERSOY
ID: 20074416
In fact it depends on the device. As a rule of thumb if one end tries to negotiate a value, the other end should try not exceed this one to prevent fragmentation. But sometimes the other end tries to keep its default setting and requires configuration too. You better try and let us know.
0
 

Author Comment

by:Paul-Brooks
ID: 20074439
ok thanks for you help, wont be tryibng it untill tomorrow but i will let you know how it works out.
0
 

Author Comment

by:Paul-Brooks
ID: 20078123
i have now managed to get the files to copy over the performance is as good as i would hope but i think i now just need to tweak it a little.
0

Featured Post

 The Evil-ution of Network Security Threats

What are the hacks that forever changed the security industry? To answer that question, we created an exciting new eBook that takes you on a trip through hacking history. It explores the top hacks from the 80s to 2010s, why they mattered, and how the security industry responded.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Note: for this to work properly you need to use a Cross-Over network cable. 1. Connect both servers S1 and S2 on the second network slots respectively. Note that you can use the 1st slots but usually these would be occupied by the Service Provide…
I've written this article to illustrate how we can implement a Dynamic Multipoint VPN (DMVPN) with both hub and spokes having a dynamically assigned non-broadcast multiple-access (NBMA) network IP (public IP). Here is the basic setup of DMVPN Pha…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

834 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question