Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Community Member

MTU path issue when VPNed in to ASA5510 8.0(4)

I have a new ASA I just setup for VPN access just like all the other ASA's I have ever setup.

The VPN client connects just fine, gets an IP, is able to ping devices on the corporate network.

I have compared it to other ASA's I have setup that work.  I can't see the issue.

3 things:

I am unable to ping the LAN interface of the ASA when VPN'ed in.

When I do a mturoute.exe to an inside IP it shows an MTU of only 196 when I use the Cisco VPN Dialer.

When I use the Shrewsoft VPN client I can set the MTU to 1380.  When I do a mturoute.exe to an inside IP it shows 1380.

I am thinking because it doesn't respond to a Ping on the LAN of the ASA that the MTU path discovery doesn't work.

Any help would be appreciated.

Thanks,

Bert

Everyone's tags (3)
1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Re: MTU path issue when VPNed in to ASA5510 8.0(4)

apologies for repeated postings but this is what you need to do

  • From a Windows device use this: C:\> ping -f -l           packet_size_in_bytes destination_IP_address.

    The -f option is used to specify that the packet           cannot be fragmented. The -l option is used to specify the           length of the packet. First try this with a packet size of 1,500. For example,           ping -f -l 1500 192.168.100. If fragmentation is required but           cannot be performed, you receive a message such as this: Packets need           to be fragmented but DF set.

    missed -f in my last post


  • #     can you try from your command prompt

           ping -f -l 1380

           so it sends a ping of 1380 bytes

    so you should see something like this if it is not getting through

    C:\Documents and Settings\jathaval>ping -f 4.2.2.2 -l 1380

    Pinging 4.2.2.2 with 1380 bytes of data:

    Packet needs to be fragmented but DF set.
    Packet needs to be fragmented but DF set.
    Packet needs to be fragmented but DF set.
    Packet needs to be fragmented but DF set.

  • 7 REPLIES
    Cisco Employee

    Re: MTU path issue when VPNed in to ASA5510 8.0(4)

    Hi,

    "management-access " should let you ping the inside ASA interface.

    Thanks,

    Naman

    Community Member

    Re: MTU path issue when VPNed in to ASA5510 8.0(4)

    management-access inside allowed me to ping the Interface but that doesn't solve the MTU issue.  The mturoute.exe still shows 196 for going through the ASA.

    Thanks,

    Bert

    Cisco Employee

    Re: MTU path issue when VPNed in to ASA5510 8.0(4)

    #    do you have command

         management-access inside

    #     can you try from your command prompt

           ping -l 1380

           so it sends a ping of 1380 bytes

    Cisco Employee

    Re: MTU path issue when VPNed in to ASA5510 8.0(4)

    can u try a ping with mss

    #     can you try from your command prompt

           ping -l 1380

           so it sends a ping of 1380 bytes

    i think this should pass

    Cisco Employee

    Re: MTU path issue when VPNed in to ASA5510 8.0(4)

    apologies for repeated postings but this is what you need to do

  • From a Windows device use this: C:\> ping -f -l           packet_size_in_bytes destination_IP_address.

    The -f option is used to specify that the packet           cannot be fragmented. The -l option is used to specify the           length of the packet. First try this with a packet size of 1,500. For example,           ping -f -l 1500 192.168.100. If fragmentation is required but           cannot be performed, you receive a message such as this: Packets need           to be fragmented but DF set.

    missed -f in my last post


  • #     can you try from your command prompt

           ping -f -l 1380

           so it sends a ping of 1380 bytes

    so you should see something like this if it is not getting through

    C:\Documents and Settings\jathaval>ping -f 4.2.2.2 -l 1380

    Pinging 4.2.2.2 with 1380 bytes of data:

    Packet needs to be fragmented but DF set.
    Packet needs to be fragmented but DF set.
    Packet needs to be fragmented but DF set.
    Packet needs to be fragmented but DF set.

  • Community Member

    Re: MTU path issue when VPNed in to ASA5510 8.0(4)

    Here are my ping results.  First my setmtu.exe is set to 1300.

    C:\>ping -f bertman2 -l 1380

    Pinging bertman2.somedomain.com [10.18.178.62] with 1380 bytes of data:
    Packet needs to be fragmented but DF set.
    Packet needs to be fragmented but DF set.
    Packet needs to be fragmented but DF set.
    Packet needs to be fragmented but DF set.

    Ping statistics for 10.18.178.62:
        Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

    C:\>ping -f bertman2 -l 1000

    Pinging bertman2.somedomain.com [10.18.178.62] with 1000 bytes of data:
    Request timed out.
    Request timed out.
    Request timed out.
    Request timed out.

    Ping statistics for 10.18.178.62:
        Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

    C:\>ping -f bertman2 -l 1272

    Pinging bertman2.somedomain.com [10.18.178.62] with 1272 bytes of data:
    Request timed out.
    Request timed out.
    Request timed out.
    Request timed out.

    Ping statistics for 10.18.178.62:
        Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

    C:\>ping -f bertman2 -l 169

    Pinging bertman2.somedomain.com [10.18.178.62] with 169 bytes of data:
    Request timed out.
    Request timed out.
    Request timed out.
    Request timed out.

    Ping statistics for 10.18.178.62:
        Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

    C:\>ping -f bertman2 -l 168

    Pinging bertman2.somedomain.com [10.18.178.62] with 168 bytes of data:
    Request timed out.
    Request timed out.
    Request timed out.
    Request timed out.

    Ping statistics for 10.18.178.62:
        Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

    C:\>ping -f bertman2 -l 1273

    Pinging bertman2.somedomain.com [10.18.178.62] with 1273 bytes of data:
    Packet needs to be fragmented but DF set.
    Packet needs to be fragmented but DF set.
    Packet needs to be fragmented but DF set.
    Packet needs to be fragmented but DF set.

    Ping statistics for 10.18.178.62:
        Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),


    C:\>ping -f bertman2 -l l00

    Pinging bertman2.somedomain.com [10.18.178.62] with 0 bytes of data:
    Reply from 10.18.178.62: bytes=0 time=309ms TTL=58
    Reply from 10.18.178.62: bytes=0 time=311ms TTL=58
    Reply from 10.18.178.62: bytes=0 time=308ms TTL=58
    Reply from 10.18.178.62: bytes=0 time=309ms TTL=58

    Ping statistics for 10.18.178.62:
        Packets: Sent = 4, Received = 4, Lost = 0 (0% loss),
    Approximate round trip times in milli-seconds:
        Minimum = 308ms, Maximum = 311ms, Average = 309ms

    It doesn't appear to be a Don't Fragment issue.  Card MTU=1300 minus 28 bytes = 1272.

    At ping -f bertman2 -l 1273 I get Packet needs to be fragmented but DF set.

    but at ping -f bertman2 -l 1272 I get Request timed out.

    It is only letting small packets through.  ping -f bertman2 -l l00 works.

    Any guesses.  I am about ready to change the code to what is on all the othere ASA's and reboot.

    Thanks,

    Bert

    Community Member

    Re: MTU path issue when VPNed in to ASA5510 8.0(4)

    Code upgrade fixed it.

    Close threads.

    Thanks for the help.

    Bert

    1458
    Views
    0
    Helpful
    7
    Replies
    CreatePlease to create content