Network Engineering Stack Exchange is a question and answer site for network engineers. It only takes a minute to sign up.
Sign up to join this community
Why I should decrease MTU on interfaces instead of increase it when ipsec encapsulation is present, GRE or some other?
The way I see it: a packet of 1500 bytes comes to the router, then there is IPSEC encapsulation and the packet becomes 1560 bytes. Why should I reduce the MTU size by 60 bytes instead of increasing it by the same 60 bytes [because the packet size is now 1560 bytes] for in order to avoid fragmentation?
It all depends on the network that you are tunneling across.
If that network is under your control, you could increase its MTU so that it can handle the tunneled payload plus the encapsulating overhead. Make sure that all devices connecting to that network can handle the new MTU or L2 frame size ("baby giants") respectively.
If the underlying network is not under your control - the more common situation - then you can't do that. Since the encapsulating packets exceed the network's MTU, fragmentation is required, putting additional load on the IPsec routers, and increasing the total overhead.
Accordingly, you can decrease the MTU before entering the tunnel (for all nodes using the tunnel). That reserves space in the outer packets to accommodate the overhead without fragmentation.
So basically, it's either
Note that in-path fragmentation is an IPv4-only thing. IPv6 does away with that by requiring PMTUD which should take care of all that automatically.
Also note that 1500 bytes is the IP MTU over standard Ethernet. There are other L2 protocols with different MTUs.
