Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

Path MTU discvery returns a value of 0

Hi All,

I have a VPN tunnel between two Cisco 2811 routers using GRE and IPSec. I had a static MTU setting of "ip mtu 1500" on the GRE tunnel but the router CPU was very high between 80-100%.

So, I removed "ip mtu 1500" and configured a "tunnel path-mtu-discovery" on the tunnel interface and also configured a global command "crypto ipsec df-bit copy".

This returned a MTU of 0. Here is the part of the output from "show int tu666" command

Tunnel666 is up, line protocol is up

Hardware is Tunnel

Internet address is x.x.x.x/30

MTU 1514 bytes, BW 100000 Kbit, DLY 100 usec,

reliability 255/255, txload 1/255, rxload 1/255

Encapsulation TUNNEL, loopback not set

Keepalive set (10 sec)

Carrier delay is 0 msec, retries 3

Tunnel source x.x.x.42, destination x.x.x.41

Tunnel protocol/transport GRE/IP, key disabled, sequencing disabled

Tunnel TTL 255

Checksumming of packets disabled, fast tunneling enabled

Path MTU Discovery, ager 10 mins, MTU 0, expires never

Tunnel transmit bandwidth 8000 (kbps)

Tunnel receive bandwidth 8000 (kbps)

Last input 00:00:04, output 00:00:03, output hang never

Last clearing of "show interface" counters 1d03h

Input queue: 0/75/0/0 (size/max/drops/flushes); Total output drops: 34416

Queueing strategy: fifo

I backed out of the changes once I saw a value of 0 and configured "ip mtu 1426" since my ping tests on each side with DF bit set returned a reply for packet size 1426 but received an "ICMP destination unreachable" message for packet size 1427. Ever since that change, customers at the remote site are complaining about slow access.

Why did the path MTU discovery failed even though the ICMP messages are not filtered? Also, why staically setting the MTU to 1426 create more problems than setting it to 1500?

Any ideas?

thanks,

1 REPLY
New Member

Re: Path MTU discvery returns a value of 0

The path MTU is 1426 due to the overhead from encapsulating the tunnel. The performance problem you are encountering is because your hosts are set for MTU=1500 which is larger than your tunnel MTU. This causes the router to fragment every packet. To resolve this you should change the MTU on your hosts to be equal or less than the MTU on your tunnel.

645
Views
0
Helpful
1
Replies
CreatePlease to create content