0

Why I should decrease MTU on interfaces instead of increase it when ipsec encapsulation is present, GRE or some other?

The way I see it: a packet of 1500 bytes comes to the router, then there is IPSEC encapsulation and the packet becomes 1560 bytes. Why should I reduce the MTU size by 60 bytes instead of increasing it by the same 60 bytes [because the packet size is now 1560 bytes] for in order to avoid fragmentation?

Improve this question
1
  • Can you increase the MTU of every device on the planet? [No] Unless you can get your ISP, and every connecting ISP, to increase the MTU everywhere that packet is going to go, it will make no difference. Increasing it just on your end will simply break your connection. (oversized frames are silently dropped.)
    – Ricky
    Jul 17, 2021 at 23:05

1 Answer 1

Reset to default
2

It all depends on the network that you are tunneling across.

If that network is under your control, you could increase its MTU so that it can handle the tunneled payload plus the encapsulating overhead. Make sure that all devices connecting to that network can handle the new MTU or L2 frame size ("baby giants") respectively.

If the underlying network is not under your control - the more common situation - then you can't do that. Since the encapsulating packets exceed the network's MTU, fragmentation is required, putting additional load on the IPsec routers, and increasing the total overhead.

Accordingly, you can decrease the MTU before entering the tunnel (for all nodes using the tunnel). That reserves space in the outer packets to accommodate the overhead without fragmentation.

So basically, it's either

  • do nothing (let routers fragment) or
  • decrease inner MTU (most reasonable) or
  • increase outer MTU (rarely possible)

Note that in-path fragmentation is an IPv4-only thing. IPv6 does away with that by requiring PMTUD which should take care of all that automatically.

Also note that 1500 bytes is the IP MTU over standard Ethernet. There are other L2 protocols with different MTUs.

Improve this answer
5
  • "Accordingly, you can decrease the MTU before entering the tunnel. That reserves space in the outer packets to accommodate the overhead without fragmentation." Ok, router will do fragmentation before encryption, then do ESP and NAT-T (or without nat-t) ecpacsulation all fragments. Do I understand this correctly? If so, what's the point, all fragmented packets will be encapsulated anyway. In case I decrease the MTU, or don't touch it at all.
    – Vladimir Fomin
    Jul 17, 2021 at 9:42
  • I mean, router receive 1500 byte packet and fragment it into two packet 1440 and 60 bytes, because I decrease MTU to 1440 on tunnel interface. And all of that packets will be encapsulated by IPSEC payload. If I don't change the MTU, router receive 1500 byte packet, add ipsec payload 60 bytes and... what router will do? Will it fragment this in two packets?
    – Vladimir Fomin
    Jul 17, 2021 at 9:54
  • Yes, the router has to fragment packets when the inner and outer MTU are both 1500 bytes.
    – Zac67 ♦
    Jul 17, 2021 at 10:00
  • Ok, router do fragmentation in both cases, if I'm not mistaken. So why do we change the MTU at all If the result is the same?
    – Vladimir Fomin
    Jul 17, 2021 at 10:15
  • Because you might want to avoid additional load of the routers and increase performance by decreasing router load and packet overhead.
    – Zac67 ♦
    Jul 17, 2021 at 11:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.