I have a number of Site-to-Site VPN tunnels in my network configurations. They are configured using Cisco ASA devices.

To resolve some performance issues I am trying to change the MTU for traffic through the VPN tunnel to 1400. My question is: In order to change the MTU for traffic through the tunnel, which interface do I need to change the MTU on? Do I just need to change it for the Outside interface? Or do I also need to change it for the Inside/other interface(s)?

  • Is this running latest ASA version which supports VTI tunnel? If it is route based, we should be changing VTI mtu directly or do set tcp mss value(to a lower value) Aug 15, 2019 at 14:13

1 Answer 1


The outside interface, but you need to be very careful with doing that, especially if you're setting the DF (don't fragment) bit rather than allowing fragmentation. If you set the DF bit and then send larger packets than the MTU allows for, you're gonna drop packets and cause issues. You will either need to make sure you're clearing the DF bit (to allow fragmentation) or make sure that you're only sending packets within your MTU range on both ends.

  • 1
    "make sure that you're only sending packets within your MTU range on both ends." Yes, use PMTUD, which is built in for IPv6 (assuming you have the proper ICMP allowed), but can be problematic for IPv4.
    – Ron Maupin
    Aug 15, 2019 at 13:28
  • @RonMaupin Yep. Most tunnels are going to have the DF bit cleared, from my experience, but you can't always assume that's the case.
    – Jesse P.
    Aug 15, 2019 at 13:32
  • @JesseP. could you please clarify the comment about the DF bit. I'm aware of the concept, and some implementations (eg. using a windows ping /f command), but in the context of your answer where are you referring to? Based on these comments there is a setting somewhere in the Site-to-Site tunnel settings that controls this?
    – Stringers
    Aug 16, 2019 at 0:42
  • @Stringers Correct. You control it on a global level, and the command is crypto ipsec df-bit clear-df <interface> in order to clear the bit, to allow fragmentation to take place if/when needed.
    – Jesse P.
    Aug 16, 2019 at 0:56
  • @JesseP. Ahh okay so similar to the MTU, this is an Interface-specific setting.
    – Stringers
    Aug 16, 2019 at 1:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.