We have a number of customers using a site-to-site VPN. These customers connect through this VPN onto an internal server. After doing some packet captures at both the VPN and the server ends. I'm noticing the following:
When the server resets its PMTUs every ten minutes (in accordance with the PMTUD protocol definition), it sends some large packets to all destinations. The VPN gateway replies with an ICMP "Destination unreachable, fragmentation needed" message for each of the destinations (as PMTUs can be different for each destination). The first ICMP message is sent out immediately, but the next ICMP message (for one of the other customer destinations) only after nearly a second, the third after about two seconds, then four, eight seconds, and so on (0ms, 1000ms, 2000ms, 4000ms, 8000ms, etc)
I was thinking to use the ip icmp rate-limit unreachable command to reduce the period to say 200ms but I need to understand why the VPN responds in this manner. I would expect the VPN to send ICMP unreachables every 500ms (the default setting). Anyone know why?