Buy or Renew
Buy or Renew
Duo Security forums now LIVE! Get answers to all your Duo Security questions. Learn more
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Search instead for 
Did you mean: 
cancel
Start a conversation
2120
Views
0
Helpful
7
Replies

MTU path issue when VPNed in to ASA5510 8.0(4)

Go to solution
bert.baker
Level 1
Level 1

‎08-11-2010 09:24 AM

I have a new ASA I just setup for VPN access just like all the other ASA's I have ever setup.

The VPN client connects just fine, gets an IP, is able to ping devices on the corporate network.

I have compared it to other ASA's I have setup that work.  I can't see the issue.

3 things:

I am unable to ping the LAN interface of the ASA when VPN'ed in.

When I do a mturoute.exe to an inside IP it shows an MTU of only 196 when I use the Cisco VPN Dialer.

When I use the Shrewsoft VPN client I can set the MTU to 1380.  When I do a mturoute.exe to an inside IP it shows 1380.

I am thinking because it doesn't respond to a Ping on the LAN of the ASA that the MTU path discovery doesn't work.

Any help would be appreciated.

Thanks,

Bert

Labels:
0 Helpful
1 Accepted Solution

Accepted Solutions

Go to solution
Jitendriya Athavale
Cisco Employee
Cisco Employee
In response to Jitendriya Athavale

‎08-11-2010 11:42 AM

apologies for repeated postings but this is what you need to do

  • From a Windows device use this: C:\> ping -f -l           packet_size_in_bytes destination_IP_address.

    The -f option is used to specify that the packet           cannot be fragmented. The -l option is used to specify the           length of the packet. First try this with a packet size of 1,500. For example,           ping -f -l 1500 192.168.100. If fragmentation is required but           cannot be performed, you receive a message such as this: Packets need           to be fragmented but DF set.

    missed -f in my last post


  • #     can you try from your command prompt

           ping -f -l 1380

           so it sends a ping of 1380 bytes

    so you should see something like this if it is not getting through

    C:\Documents and Settings\jathaval>ping -f 4.2.2.2 -l 1380

    Pinging 4.2.2.2 with 1380 bytes of data:

    Packet needs to be fragmented but DF set.
    Packet needs to be fragmented but DF set.
    Packet needs to be fragmented but DF set.
    Packet needs to be fragmented but DF set.

    • View solution in original post

    0 Helpful
    7 Replies 7

    Go to solution
    mulatif
    Cisco Employee
    Cisco Employee

    ‎08-11-2010 11:20 AM

    Hi,

    "management-access " should let you ping the inside ASA interface.

    Thanks,

    Naman

    0 Helpful

    Go to solution
    bert.baker
    Level 1
    Level 1
    In response to mulatif

    ‎08-11-2010 11:29 AM

    management-access inside allowed me to ping the Interface but that doesn't solve the MTU issue.  The mturoute.exe still shows 196 for going through the ASA.

    Thanks,

    Bert

    0 Helpful

    Go to solution
    Jitendriya Athavale
    Cisco Employee
    Cisco Employee

    ‎08-11-2010 11:22 AM

    #    do you have command

         management-access inside

    #     can you try from your command prompt

           ping -l 1380

           so it sends a ping of 1380 bytes

    0 Helpful

    Go to solution
    Jitendriya Athavale
    Cisco Employee
    Cisco Employee
    In response to Jitendriya Athavale

    ‎08-11-2010 11:36 AM

    can u try a ping with mss

    #     can you try from your command prompt

           ping -l 1380

           so it sends a ping of 1380 bytes

    i think this should pass

    0 Helpful

    Go to solution
    Jitendriya Athavale
    Cisco Employee
    Cisco Employee
    In response to Jitendriya Athavale

    ‎08-11-2010 11:42 AM

    apologies for repeated postings but this is what you need to do

  • From a Windows device use this: C:\> ping -f -l           packet_size_in_bytes destination_IP_address.

    The -f option is used to specify that the packet           cannot be fragmented. The -l option is used to specify the           length of the packet. First try this with a packet size of 1,500. For example,           ping -f -l 1500 192.168.100. If fragmentation is required but           cannot be performed, you receive a message such as this: Packets need           to be fragmented but DF set.

    missed -f in my last post


  • #     can you try from your command prompt

           ping -f -l 1380

           so it sends a ping of 1380 bytes

    so you should see something like this if it is not getting through

    C:\Documents and Settings\jathaval>ping -f 4.2.2.2 -l 1380

    Pinging 4.2.2.2 with 1380 bytes of data:

    Packet needs to be fragmented but DF set.
    Packet needs to be fragmented but DF set.
    Packet needs to be fragmented but DF set.
    Packet needs to be fragmented but DF set.

    • 0 Helpful

    Go to solution
    bert.baker
    Level 1
    Level 1
    In response to Jitendriya Athavale

    ‎08-11-2010 12:26 PM

    Here are my ping results.  First my setmtu.exe is set to 1300.

    C:\>ping -f bertman2 -l 1380

    Pinging bertman2.somedomain.com [10.18.178.62] with 1380 bytes of data:
    Packet needs to be fragmented but DF set.
    Packet needs to be fragmented but DF set.
    Packet needs to be fragmented but DF set.
    Packet needs to be fragmented but DF set.

    Ping statistics for 10.18.178.62:
        Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

    C:\>ping -f bertman2 -l 1000

    Pinging bertman2.somedomain.com [10.18.178.62] with 1000 bytes of data:
    Request timed out.
    Request timed out.
    Request timed out.
    Request timed out.

    Ping statistics for 10.18.178.62:
        Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

    C:\>ping -f bertman2 -l 1272

    Pinging bertman2.somedomain.com [10.18.178.62] with 1272 bytes of data:
    Request timed out.
    Request timed out.
    Request timed out.
    Request timed out.

    Ping statistics for 10.18.178.62:
        Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

    C:\>ping -f bertman2 -l 169

    Pinging bertman2.somedomain.com [10.18.178.62] with 169 bytes of data:
    Request timed out.
    Request timed out.
    Request timed out.
    Request timed out.

    Ping statistics for 10.18.178.62:
        Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

    C:\>ping -f bertman2 -l 168

    Pinging bertman2.somedomain.com [10.18.178.62] with 168 bytes of data:
    Request timed out.
    Request timed out.
    Request timed out.
    Request timed out.

    Ping statistics for 10.18.178.62:
        Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

    C:\>ping -f bertman2 -l 1273

    Pinging bertman2.somedomain.com [10.18.178.62] with 1273 bytes of data:
    Packet needs to be fragmented but DF set.
    Packet needs to be fragmented but DF set.
    Packet needs to be fragmented but DF set.
    Packet needs to be fragmented but DF set.

    Ping statistics for 10.18.178.62:
        Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),


    C:\>ping -f bertman2 -l l00

    Pinging bertman2.somedomain.com [10.18.178.62] with 0 bytes of data:
    Reply from 10.18.178.62: bytes=0 time=309ms TTL=58
    Reply from 10.18.178.62: bytes=0 time=311ms TTL=58
    Reply from 10.18.178.62: bytes=0 time=308ms TTL=58
    Reply from 10.18.178.62: bytes=0 time=309ms TTL=58

    Ping statistics for 10.18.178.62:
        Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
    Approximate round trip times in milli-seconds:
        Minimum = 308ms, Maximum = 311ms, Average = 309ms

    It doesn't appear to be a Don't Fragment issue.  Card MTU=1300 minus 28 bytes = 1272.

    At ping -f bertman2 -l 1273 I get Packet needs to be fragmented but DF set.

    but at ping -f bertman2 -l 1272 I get Request timed out.

    It is only letting small packets through.  ping -f bertman2 -l l00 works.

    Any guesses.  I am about ready to change the code to what is on all the othere ASA's and reboot.

    Thanks,

    Bert

    0 Helpful

    Go to solution
    bert.baker
    Level 1
    Level 1
    In response to bert.baker

    ‎08-11-2010 12:43 PM

    Code upgrade fixed it.

    Close threads.

    Thanks for the help.

    Bert

    0 Helpful
    Customers Also Viewed These Support Documents