Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

Fragmentation

I have 2 sites that are connected through IPSEC VPN between 2 PIX 525 firewalls and i have replication between 2 NETAPP storage devices that is not performing and it appears that the MTU and fragmentation is affecting it. When i do a ping with size 1500 from one side to the other it fails and as I lower at 1200 it succeeds. I told the firewall to fragment before encryption and set the inside and outside interfaces to 1200 MTU and still no luck. Any ideas

6 REPLIES
Silver

Re: Fragmentation

Change the TCP MSS on PIXs

sysopt connection tcp-mss MSS_size_in_bytes

example : sysopt connection tcp-mss 1200

New Member

Re: Fragmentation

that didn't seem to help still can't ping across with a ping set to 1500 MTU

Re: Fragmentation

Try this on both sides (PIX firewalls):

crypto ipsec df-bit clear-df outside

Where 'outside' is your egress VPN interface.

Regards

Farrukh

Re: Fragmentation

I agree with Farrukh - a solid solution, I would add one more thing, to fragement "BEFORE" encryption - not after:-

crypto ipsec fragmentation before-encryption outside.

I prefer to fragement a clear packet rather than an encrypted packet - jut my personal preference.

HTH>

New Member

Re: Fragmentation

Where is the appropriate place to tell the PIX what the MSS size should be?

Re: Fragmentation

In the pix it's a global setting - you can;t define an interface or direction.

Any tcp - syn or syn ack that the firewall see's it will change the MSS to the configured value.

HTH>

203
Views
5
Helpful
6
Replies
CreatePlease to create content