MTU IPSec Zero Route
Posted on 2012-08-21
I have been working on this problem for quite some time now with zero results.
For some reason even after working out the correct MTU (with ping –f –l xxxx or mtupath.exe) I still get terrible/no results on web browsing speed. Now it seems as if I need to reboot the remote box every day or two for web browsing to reestablish. All other traffic passes fine, http doesn’t.
Main site is running a Watchguard x550, external interface on an Ethernet line.
Remote is running a Watchguard x15, external interface on a PPPoE line.
There is an IPSec tunnel between the two locations with a zero route to force the traffic through the main site for web blocker purposes.
MTU on main\external-interface is set to 1500. (Best I could get)
MTU on remote\external-interface is set to 1400 (Best I could get)
Websites do not load. Unless…
If I change the MTU on Main\external-interface to 1492 the remote sites are fast and web browsing is perfect.
Why would changing the main\external-interface MTU to 1492 solve the remote speed issues?
Here is the MTU I worked out with mtupath.exe and the same results with the simple DOS command:
From Main, To Internet, MTU=1500
From Main, To Remote, MTU=1436
From Remote, To Internet, MTU=1400
From Remote, To Main, MTU=1436
If I remove the zero route on the VPN tunnel then web traffic is fine.