Re: IP tunnel MTU

["Dobbins, Roland" <rdobbins () arbor net>]

On Oct 23, 2012, at 5:24 AM, Templin, Fred L wrote:

> Since tunnels always reduce the effective MTU seen by data packets due to the encapsulation overhead, the only two 
> ways to accommodate
> the tunnel MTU is either through the use of path MTU discovery or through fragmentation and reassembly.

Actually, you can set your tunnel MTU manually.

For example, the typical MTU folks set for a GRE tunnel is 1476.

This isn't a new issue; it's been around ever since tunneling technologies have been around, and tons have been written 
on this topic.  Look at your various router/switch vendor Web sites, archives of this list and others, etc.

So, it's been known about, dealt with, and documented for a long time.  In terms of doing something about it, the 
answer there is a) to allow the requisite ICMP for PMTU-D to work to/through any networks within your span of 
administrative control and b) adjusting your own tunnel MTUs to appropriate values based upon experimentation.

Enterprise endpoint networks are notorious for blocking *all* ICMP (as well as TCP/53 DNS) at their edges due to 
'security' misinformation propagated by Confused Information Systems Security Professionals and their ilk.  Be sure 
that your own network policies aren't part of the problem affecting your userbase, as well as anyone else with a need 
to communicate with properties on your network via tunnels.

-----------------------------------------------------------------------
Roland Dobbins <rdobbins () arbor net> // <http://www.arbornetworks.com>

          Luck is the residue of opportunity and design.

                       -- John Milton