Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

IPsec and MTU (Path MTU Discovery)


We are using a 3030 consentrator to terminate our VPN connections. Some users are connected to the Internet using ADSL, and they have a problem with Path MTU Discovery. As I understand there is now support for this in the new software. But will turning this on reset the interface an cause an possible disconect for already connected users.Also,are there any guidelines for what MTU value I should use one the Interface. I guess the support for Path MTU Discovery should be used on the public interface?

New Member

Re: IPsec and MTU (Path MTU Discovery)

most ipsec installations i have seen or supported have the mtu set for 1492

Cisco Employee

Re: IPsec and MTU (Path MTU Discovery)

Yes , the IP fragmentation policy (available as of VPN 3000 Release 3.6) is turned on for the public interface.

Changing the setting will reset the interface and thus bring down your tunnels.

Here is a help link for an explanation of the feature:


New Member

Re: IPsec and MTU (Path MTU Discovery)

One more thing. Is Path MTU Discovery end-to-end. Does it have to be supported on both the client and the terminating device? The reason I ask is that our ISP do not use Path MTU Discovery but thecompany offering ADSL to some of our users are. ( Would it in that case be enough that the clients supports it)..