?
Solved

Is this Cisco router programing right?

Posted on 2009-07-15
8
Medium Priority
?
497 Views
Last Modified: 2013-12-12
I have been having a problem with  a GRE tunnel. It is making my MTU 1476.  I was told by a number of sources that enabling ICMP to re-negotiate the MTU size will do the trick. These are the lines I entered into the router. Are they right?

access-list 101 permit icmp any any unreachable
access-list 101 permit icmp any any time-exceeded
access-list 101 permit icmp any any packet-too-big
access-list 101 deny icmp any any

All commands were accepted.
0
Comment
Question by:ChiefIT
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 4
  • 2
  • 2
8 Comments
 
LVL 34

Assisted Solution

by:Istvan Kalmar
Istvan Kalmar earned 1000 total points
ID: 24864260
Use the ip tcp adjust-mss command on the tunnel interfaces so that the router will reduce the TCP MSS value in the TCP SYN packet. This will help the two end hosts (the TCP sender and receiver) to use packets small enough so that PMTUD is not needed.
0
 
LVL 34

Accepted Solution

by:
Istvan Kalmar earned 1000 total points
ID: 24864266
0
 
LVL 16

Assisted Solution

by:memo_tnt
memo_tnt earned 1000 total points
ID: 24864270
yes it;s correct ...
 
 
0
VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

 
LVL 39

Author Comment

by:ChiefIT
ID: 24864653
@ IKALMAR:

The only problem with the Tunneling interface is I don't have control of it.

Here is how the network topology looks like:

My LAN>>satellite connection>>NOC1 router for a large WAN>>((GRE TUNNEL))>>Headquarters NOC>>WWW

I am good on the WAN side of NOC1, with everything set at 1500, going through to headquarters and the WWW is giving me fits. So, I did an MTU ping to google.com, and it came back as

packet to large and DF is set.

I would love to control those Tunnel interfaces. Then, I would make the MTU size on those interfaces 1524, and no problems from there on out for the entire WAN.

For my case, I beleive I have to allow ICMP to renegotiate the MTU window for me until our two NOCs figure it out and come up with a fix on that GRE tunnel.


Do you have any other suggestions. I could call the Chief Information Officer and have him look into our Tunnel adapters.

0
 
LVL 39

Author Comment

by:ChiefIT
ID: 24864666
@memo:

I don't quite understand the last line:

"access-list 101 deny icmp any any"

Why deny it after you just permitted it in the lines above?
0
 
LVL 16

Assisted Solution

by:memo_tnt
memo_tnt earned 1000 total points
ID: 24864742

ICMP has a lot of parameters check this ACL:

access-list 111 permit icmp any any administratively-prohibited
access-list 111 permit icmp any any echo
access-list 111 permit icmp any any echo-reply
access-list 111 permit icmp any any packet-too-big
access-list 111 permit icmp any any time-exceeded
access-list 111 permit icmp any any traceroute
access-list 111 permit icmp any any unreachable  

So, when you deny ICMP any any at the end that means anything else after permitting the first parameters
access-list 101 permit icmp any any unreachable
access-list 101 permit icmp any any time-exceeded
access-list 101 permit icmp any any packet-too-big

will be discard ..

that's why

BR
0
 
LVL 39

Author Comment

by:ChiefIT
ID: 24865579
I am in contact with the two NOCs to see if they will raise the Tunneling router's Maximum Segment size. I really appreciate your help. For now, the ICMP edits did the trick.

For the rest of the WAN, they are going to have problems. So, I am going to escolate this to the NOC level.

Thanks you guys, you have been a huge help all the way through this ordeal. For a bonehead at Cisco Routing, I sure appreciated your help.

0
 
LVL 39

Author Closing Comment

by:ChiefIT
ID: 31603996
Exactly what I was looking for.  Thanks, for alternative options ikalmar.

Thanks for verification and answering my concerns about the ICMP lines memo.
0

Featured Post

Industry Leaders: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

In the hope of saving someone else's sanity... About a year ago we bought a Cisco 1921 router with two ADSL/VDSL EHWIC cards to load balance local network traffic over the two broadband lines we have, but we couldn't get the routing to work consi…
You deserve ‘straight talk’ from your cloud provider about your risk, your costs, security, uptime and the processes that are in place to protect your mission-critical applications.
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…
Suggested Courses

771 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question