Applications fail when "mpls mtu 1526" is configured

Question

Hi,
I'm facing an issue with an MPLS VPN backbone.
A customer's IP host at one location can ping and traceroute to application servers at it's central site at another location. The IP path traverses four P/PE routers, as follows:
IP Host (spoke site) -- CE1 -- P/PE1 -- P/PE2 -- P/PE3 -- P/PE4 -- CE2 -- Servers (central site)
However, access to all applications fails.
Network configurations as follows:
(1) All the P/PE routers are Cisco 7609, SUP720-3BXL, IOS 12.2(18)SXF6.
(2) All the core links are configured with "mpls mtu 1526".
(3) All the core links are GE, connected to SPA-2X1GE on a 7600-SIP-400 linecard. Some connect to the SFP port on the SUP720.
(4) Only some of the P/PE routers are configured with "ip tcp path-mtu-discovery".
After removing the command "mpls mtu 1526" from all core links, access to all applications and services works again.
Please advise if I've configured anything wrongly.
Thank you.
B.Rgds,
Lim TS

Answer 1

There are two ways to look at this,
1) First To solve the problem, on all your Core and Core Facings links configure "mtu 1526 or larger" (PE-P, P-P) mtu 1526 or larger.
2) Second "MPLS MTU 1526" command only helps in labelling the fragmented payload which is beyond 1526. Till then if anything is fragmented it doesnt label the fragments.
So now why does it work when its removed,
a) verify what is your actual link mtu.
b) "mpls mtu" command doesnt change the physical mtu it just tells the IOS when to label fragments. and the 1526 is the threshold to fragment the labelled packet and label the fragments also.
c) One important thing to note is even when you dont configure the "mpls mtu" command it is still there by default but now it uses the MTU value of the physical link, so if your link is of 1500 MTU the default "mpls mtu" is also 1500.!
d) also go through this previous thread for more information the same topic has been discussed at length.
MPLS: MTU Ethernet MPLS Network Sep 26, 2006
HTH-Cheers,
Swaroop.