What is the best MTU for VPN?
Configure your peer VPN gateway to use an MTU of no greater than 1460 bytes. We recommend a value of 1460 bytes because that matches the default MTU setting for Google Cloud virtual machine (VM) instances.
Does IPsec support ICMP?
IPsec naturally has to interact with every protocol of the IP suite, and in particular the Internet Control Message Protocol (ICMP). The goal of ICMP is to exchange control and error messages, like packet processing error notifica- tions. Assessing the correct packet size on a network path is therefore a key aspect.
Is the MTU size too big for IPsec?
The MTU size does not account for the IPSEC overhead. After some testing with different packet sizes I hit on the magic number: 1384 bytes. At 1385 the packets were again rejected as being too large.
Where is the IP MTU in GRE tunnel interface?
For GRE over IPsec, the IP MTU of the GRE tunnel interface should be set below the egress interface MTU by at least the overhead of IPsec encryption and the 24-byte GRE+IP header (20-byte IP header plus 4-byte GRE header). Because options such as tunnel key (RFC 2890) are not supported, the GRE+IP IP header will always be 24 bytes.
How big should the MTU be on a VPN?
After some testing with different packet sizes I hit on the magic number: 1384 bytes. At 1385 the packets were again rejected as being too large. So some quick math: This leaves 88 bytes as the IPSEC header. I should be able to set the MTU size on the controller to 1412 and the access points should resume functioning normally.
How can I test across our IPsec tunnel?
So now to test across our IPSEC tunnel: Packet needs to be fragmented but DF set. Packet needs to be fragmented but DF set. Packet needs to be fragmented but DF set. Packet needs to be fragmented but DF set. Now this makes sense. The MTU size does not account for the IPSEC overhead.