Re: [nn] How to reduce MTU for a VPN tunnel?

[Matt Florido <matt@floridonet.com>]

* Marc Haber <mh+qorbit-nn@zugschlus.de> [03-23-2007 19:18]:

> Hi,
> 
> Now my questions
> 
> (1) Are there any known MTU issues in ScreenOS 5.3.0r6.0 for the 5GT?

Nothing major listed in the release notes.

> (2) How can I for testing purposes reduce the MTU the NSR client uses
>     for data sent into the VPN tunnel? Setting the appropriate registry
>     key on the virtual ethernet adapter does not work; the setting is
>     simply igored (verified by ping with a big request packet)

Try setting the MTU setting on the network adapter itself instead
of the virtual adapter for NSR.

> (3) Why do such MTU issues only surface with one application?
>     Everything else seems to be just fine.

You have only found it in one application, but I've found the issue
manifests itself when applications like using max packet sizes.

> (4) Which debugging steps would you guys take?
> 
> Any hints wil be appreciated.
> 
> Greetings
> Marc
> 

Here's something to try.  Adjust the TCP MSS settings on your NS5GT.

set flow tcp-mss xxx (1300 is a good number to test with)
set flow all-tcp-mss xxx (1400)

-- 
Regards,
Matt Florido
_______________________________________________
nn mailing list
nn@qorbit.net
http://qorbit.net/mailman/listinfo/nn