Mtu & packet size for ssh & https through vpn

Hi
I've been noticing problems with dropped packets in secure protocols through our site-to-site vpns since migrating the central site over from a pix to an isr. It looks as though packets for protocols such as ssh / https could not be fragmented before transmission down the tunnel and were already too big to accomodate the tunnel overheads within the router interface mtu of 1500.
Could this be the case?
Dropping the mtu to 1400 for the machine initiating the ssh connection at the remote site seems to have solved the problem, but I am wondering why this has only started with the ISR?
I am also seeing very slow throughput in one vpn link from the ISR to an 831 router at a remote site where both routers have an mtu of 1500. Again this is just since the pix was swapped with the ISR. I've dropped encryption down to basic des / md5 and I've cleared a lot of old unused lines out of the acls which has doubled the throughput to ~ 500Kbps, but this is still not the performance we were seeing previously. The processor on the 831 is also getting hammered and is generally ~ 72% when the throughput is 500Kbps (onboard hardware encryption enabled). There also may be a bug in the IOS version on the 831 as the ip mtu nnnn & ip tcp adjust-mss nnnn can be entered but don't stick for eth0.
Sorry about the length of this post and the number of questions, but would appreciate any comments.
Cammy

Cammy,
It looks like you've answered most of your own questions and a review of your code versions and the capability of the devices onsite may need to be reviewed in terms of requirements and throughput. You identify that the key difference is the ISR and the fix was to set the mtu on the host machine. In an effort to understand what your seeing sent and what's received then I'd recommend that you look to implementing a wire trace if viable at each end. Smells of tcp auto-tuning but that would be shooting from the hip.
Julian
Sent from Cisco Technical Support iPad App

Similar Messages

How do I change packet size for a single load

All,
I need to change the packet size for a single load I'm doing. How do I set that?
Thanks.
Dave

Hi..........
For this u hav to go to the infopackage scheduler........
If u r in Process chain >> Right click on the infopackage >> Maintain variant..........then it will come to the IP scheduler..................In the Top Scheduler Tab >> Click on it and select DataS. Default data transfer .......Now there may be a delta IP and Full upload IP for the same datasource.......check ur IP .....it is full or delta..........if full change the packet size for full upload..............otherwise for delta upload........
If the IP is not a part of any Process chain..........then go to RSA1 >> Find the IP..........and double click on it........then the IP scheduler screen will open..........
You can make global settings for all datasources...... in the transaction SBIW in the area General Settings >> Maintain control Parameter for Data transfer......... The parameters that you maintain here are valid as global standard values, and thus apply to all DataSources.
Hope this helps.....
Regards,
Debjani........
Edited by: Debjani Mukherjee on Nov 13, 2008 2:19 PM

Configuring Packet size for IDOCS on outbound Side

Folks,
Can we configure the packet size for idocs on the onutbound side of the Adapter ?
Manish

Hi Manish,
It is posible if all 1000 idocs are of same Idoc type.
Jus go and change the occurene of Idoc in the XSD as 1..Unbounded. SO that your the message can hold multiple Idocs.
But let me clarify here, if you send 1000 idocs from R3 , it will come to XI as one-by-one. There is no mechanism to get 1000 idocs at a time. So you need to collec all the idocs and then send it.
Just have quick look into this
Packaging IDOCs - SAP R3(IDOCs) -> XI -> Flat File
Regards,
Moorthy

Unable to access Internal HTTPS through VPN conn

Anytime I have internal websites with HTTPS connections that do not have valid certificates, our VPN users are unable to make a connection. The wireshark trace shows acknowlegement number = broken TCP. I have run Packet Tracer and it shows a problem on my DMZ???? not sure why as the traffic flow is inside to inside interface. I am at a total lost as to why...
+++++++++++++++++++++++++++++++
ASA 5520 with 8.4(1) code
VPN Addressing = 172.25.17.0/24
HTTP Server = 172.18.2.13 (port 8443)
Can ping by IP Address or by server name
Can access site internally after responding to the Certificate Warning
++++++++++++++++++++++++++++
Any help is greatly appreciated!
Dave

Hi,
The NAT configuration mentioned in your screencapture is the configuration that causes all traffic from the VPN users to be diverted to the "HomeOffice" interface because "any any" is configured
You would either have to make the above rule more specific by removing the "any any" and adding the actual networks
OR
You could add a new rule BEFORE the above mentioned NAT configurations
I am not sure what the real local interface "nameif" is (the one where the server IP is actually located) but you would need this kind of configurations
object network SERVER
host 172.18.2.13
object network VPN-POOL
subnet 172.25.17.0 255.255.255.0
nat (serverint,outside2) 1 source static SERVER SERVER destination static VPN-POOL VPN-POOL
The above rule should match the traffic from the VPN-POOL to the SERVER. The number "1" seen in the CLI format configurations means that it would be added to the top of the rules. The "serverint" is meant to mean the actual name of the interface where the server is located as I presume that its not located behind the "HomeOffice"
- Jouni

Default maximum packet size in 3.7.0.1

Hello,
It looks like there is another reason for performing a full cluster restart to apply the first patch for 3.7 (3.7.0.1). On a machine with MTU=1500, it appears that the default maximum packet size value was changed from 1452 to 65535 and this change prevents the cluster from forming during a rolling upgrade.
16 May 2011 14:08:01,376 ERROR Logger@813856187 3.7.0.1: 2011-05-16 14:08:01.376/1.539 Oracle Coherence GE 3.7.0.1 <Error> (thread=Cluster, member=n/a): This member could not join the cluster because of a configuration mismatch between this member and the configuration being used by the rest of the cluster. The maximum packet size (65535) for this member does not match the maximum packet size that the running cluster is using. Rejected by Member(Id=1, Timestamp=2011-05-16 14:05:49.303, Address=XXX2:11500, MachineId=38601, Location=machine:YYY2,process:14945,member:cacheserver:1, Role=cacheserver).
16 May 2011 14:24:27,675 ERROR Logger@98371294 3.7.0.0: 2011-05-16 14:24:27.674/1.539 Oracle Coherence GE 3.7.0.0 <Error> (thread=Cluster, member=n/a): This member could not join the cluster because of a configuration mismatch between this member and the configuration being used by the rest of the cluster. The maximum packet size (1452) for this member does not match the maximum packet size that the running cluster is using. Rejected by Member(Id=1, Timestamp=2011-05-16 14:11:11.927, Address=XXX1:11500, MachineId=38600, Location=machine:YYY1,process:18509,member:cacheserver:1, Role=cacheserver).
Can you please confirm?
Cheers,
Alexey

Hi Alexey,
Yes, the default maximum packet size for 3.7 was supposed to have been 65535, there was however a bug which prevented this from working. 3.7.0.1 fixes this issue, and thus "introduces" the new higher default value. A rolling restart is still possible, you would however need to manually configure the maximum to be 1468. The new maximum of 65535 allows the Coherence default configuration to support large clusters (greater then ~450 JVMs), where as the old default configuration would prevent new members from joining and would require a re-configuration and full restart.
thanks,
Mark
Oracle Coherence

Network Packet Size Or Bandwidth Restriction in Database Mirroring

Hi Everyone,
I tried finding online but couldn't get answer to the below question.
Is it possible to restrict the packet size for the SQL Database Mirroring? Is it possible to tell database mirroring what size packets it should send to the mirrored database? Is it possible to define the bandwidth or packets per second for mirroring? If
yes, is it possible at the server level or database level? If yes, how to do this?
The reason that I want to know this is because, if I have N number of databases on a server and I'm mirroring them on other server in a separate location, how will I get to know the bandwidth constraint and if there is a bandwidth constraint can I control
the data sent through database mirroring to ensure that the bandwidth is not affected?
Thanks
Mayur Kashikar

Database Mirroring has no such setting specific to "per database" or "per server" which can limit the packets sent over the wire. Remember that communication of database doesn't happen via regular port. There is a separate port use by
database mirroring (generally 5022)
Network packet size is setting which is for communication happening on regular connection port (i.e. TDS packets). Database mirroring doesn't use TDS packets but it uses the Service Broker network stack.
In short, there is no such setting which can control the communication the way you want.
If you search for Jumbo Frame, you might get some reference about performance gain but remember that if you use Jumbo frame then it has to be supported by each and every component in the network else you would have packet drop and mirroring would be
disconnected.
Balmukund Lakhani
Please mark solved if I've answered your question, vote for it as helpful to help other users find a solution quicker
This posting is provided "AS IS" with no warranties, and confers no rights.
My Blog |
Team Blog | @Twitter
| Facebook
Author: SQL Server 2012 AlwaysOn -
Paperback, Kindle

Packet size in SAP 4.7

BW experts,
I need data packages from SAP 4.7 to get 50000 rows at one in a single packet. Right now in BW it is set to get 20000 max per packet. Where can I change it to get more per packet. I am not able to do it on BW side as it say the maximum source system will allow is 20000, where in the source system (SAP 4.7) can I make this change?
Thanks
Ashwin

Hi..
Configuring ROIDOCPRMS table
Transaction SBIW
General Settings->Maintain Control Parameters for Data Transfer
Refer OSS Note : 417307
About ROIDOCPRMS
It is an IDOC parameter source system. This table contains the details of the data transfer like the source system of the data, data packet size, maximum number of lines in a data packet, etc. The data packet size can be changed through the control parameters option on SBIW i.e., the contents of this table can be changed.
with regards,
harikv

SSH to ASA through VPN

Here is a variation on a theme I've seen on the boards here. I have an ASA 5580 configured for client ipsec vpns. I can connect via the vpn, ping the interface being used for management, and complete the TCP handshake for telnet or SSH. After that, the connection times out. I know I'm missing something small, but can't find it. Any help would be greatly appreciated.
Here are the relevant parts of the config:
interface TenGigabitEthernet0/8
nameif INSIDE
security-level 100
ip address 10.50.254.249 255.255.255.248 standby 10.50.254.250
interface GigabitEthernet0/0
nameif OUTSIDE
security-level 0
ip address x.x.x.x x.x.x.x
interface GigabitEthernet0/1
nameif ToMGMT
security-level 10
ip address 10.50.253.18 255.255.255.0
ftp mode passive
dns server-group DefaultDNS
domain-name local
object-group network Inside_NETWORK_ALL
network-object 10.0.0.0 255.0.0.0
network-object 172.16.0.0 255.248.0.0
object-group network Outside_REMOTE_VPN
network-object 10.50.224.0 255.255.254.0
object-group network MGMT_NET
network-object 10.50.253.0 255.255.255.0
access-list PERMIT_ANY extended permit ip any any
access-list RemoteVPN_SPLIT standard permit 10.50.253.0 255.255.255.0
access-list RemoteVPN_SPLIT standard permit 10.50.0.0 255.255.0.0
access-list RemoteVPN_SPLIT standard permit 10.50.224.0 255.255.254.0
access-list NO-NAT-VPN extended permit ip any 10.50.224.0 255.255.254.0
access-list MGMT-2-VPN extended permit ip 10.50.253.0 255.255.255.0 10.50.224.0 255.255.254.0
mtu INSIDE 1500
mtu OUTSIDE 1500
mtu ToMGMT 1500
ip local pool RemoteVPN_POOL 10.50.224.0-10.50.225.0 mask 255.255.254.0
monitor-interface DMZ
no monitor-interface OUTSIDE
icmp unreachable rate-limit 1 burst-size 1
no asdm history enable
arp timeout 14400
nat (INSIDE,any) source static Inside_NETWORK_ALL Inside_NETWORK_ALL destination static Inside_NETWORK_ALL Inside_NETWORK_ALL
nat (INSIDE,OUTSIDE) source dynamic Inside_NETWORK_ALL interface
access-group OUTSIDE_IN in interface OUTSIDE
route OUTSIDE 0.0.0.0 0.0.0.0 200.200.100.10 1
route INSIDE 10.50.0.0 255.255.224.0 10.50.254.254 1
route INSIDE 10.50.253.0 255.255.255.0 10.50.254.254 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
dynamic-access-policy-record DfltAccessPolicy
aaa-server RADIUS_COLO protocol radius
aaa authentication enable console LOCAL
aaa authentication serial console LOCAL
aaa authentication ssh console LOCAL
crypto ipsec ikev1 transform-set ESP-AES-256-MD5 esp-aes-256 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-DES-SHA esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-DES-MD5 esp-des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-MD5 esp-aes-192 esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto ipsec ikev1 transform-set ESP-AES-256-SHA esp-aes-256 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-SHA esp-aes esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-128-MD5 esp-aes esp-md5-hmac
crypto ipsec ikev1 transform-set 3dessha-Transport esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set 3dessha-Transport mode transport
crypto ipsec ikev1 transform-set dessha esp-des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set 3dessha esp-3des esp-sha-hmac
crypto ipsec ikev1 transform-set ESP-AES-SHA esp-aes esp-sha-hmac
crypto dynamic-map RemoteVPN_DM 5 set ikev1 transform-set 3dessha
crypto dynamic-map PUB_IPSEC_CLIENT 1 set ikev1 transform-set ESP-3DES-MD5
crypto map CRYPTO_MAP 1 ipsec-isakmp dynamic RemoteVPN_DM
crypto map CRYPTO_MAP 2 ipsec-isakmp dynamic PUB_IPSEC_CLIENT
crypto map CRYPTO_MAP interface OUTSIDE
crypto isakmp identity key-id ***********
crypto ikev1 enable OUTSIDE
crypto ikev1 policy 65534
authentication pre-share
encryption 3des
hash sha
group 2
lifetime 86400
crypto ikev1 policy 65535
authentication pre-share
encryption 3des
hash md5
group 2
lifetime 86400
ssh 10.0.0.0 255.0.0.0 INSIDE
ssh 10.50.253.0 255.255.255.0 ToMGMT
ssh 10.50.224.0 255.255.254.0 ToMGMT
ssh 10.0.0.0 255.0.0.0 ToMGMT
ssh timeout 5
ssh version 2
console timeout 0
management-access ToMGMT
tls-proxy maximum-session 1000
ssl trust-point localtrust OUTSIDE
webvpn
enable OUTSIDE
anyconnect image disk0:/anyconnect-win-2.5.3055-k9.pkg 1
anyconnect enable
tunnel-group-list enable
group-policy SSLClientPolicy internal
group-policy SSLClientPolicy attributes
dns-server value 10.50.223.10
vpn-tunnel-protocol ssl-client
split-tunnel-policy tunnelspecified
split-tunnel-network-list value RemoteVPN_SPLIT
address-pools value RemoteVPN_POOL
group-policy RemoteVPN internal
group-policy RemoteVPN attributes
dns-server value 10.200.0.6
password-storage enable
split-tunnel-network-list value RemoteVPN_SPLIT
group-policy IPSEC-POLICY internal
group-policy IPSEC-POLICY attributes
vpn-simultaneous-logins 20
vpn-tunnel-protocol ikev1
ip-comp enable
split-tunnel-policy tunnelspecified
split-tunnel-network-list value RemoteVPN_SPLIT
user-authentication enable
tunnel-group RemoteVPN type remote-access
tunnel-group RemoteVPN general-attributes
address-pool RemoteVPN_POOL
default-group-policy RemoteVPN
tunnel-group RemoteVPN ipsec-attributes
ikev1 pre-shared-key *****
tunnel-group SSLClientProfile type remote-access
tunnel-group SSLClientProfile general-attributes
default-group-policy SSLClientPolicy
tunnel-group SSLClientProfile webvpn-attributes
group-alias SSLVPNClient enable
tunnel-group IPSECGROUP type remote-access
tunnel-group IPSECGROUP general-attributes
address-pool RemoteVPN_POOL
default-group-policy IPSEC-POLICY
authorization-required
tunnel-group IPSECGROUP ipsec-attributes
ikev1 pre-shared-key *****
class-map inspection_default
match default-inspection-traffic

Michael,
TFTP should work through VPN, I have tested through RA VPN. I do not see a reason why should not work through l2l vpn scenario.
http://www.cisco.com/en/US/docs/security/asa/asa80/command/reference/t.html#wp1498951
In RA vpn scenario where client runs the tftp server.
In RA VPN test scenario,VPN client gets IP 140.40.30.15 assigned.
asa5500fw(config)#tftp-server inside
tftp-server 140.40.30.15 f:\
asa5500fw(config)# copy running-config tftp:
Source filename [running-config]?
Address or name of remote host [140.40.30.15]?
Destination filename []? running-config
Cryptochecksum: 67f2f1a3 c31d5a9b 0f6b1f6d 2f21766d
26019 bytes copied in 3.460 secs (8673 bytes/sec)
In your scenario with l2l vpn as long the tftp server IP on other side of tunnel is part of the IPsec tunnel policy try this bellow.
tftp-server outside
Regards

Is there any limitaion for JDBC packet size?

Hi there,
my question is if JDBC like ODBC have the 4k
packet size? If so, is there a way to increase it and if so, what will be the maximum acceptable size for it?
Thanks a lot.
null

Oracle supports JDBC at least as far back as 8.1.something; the Oracle JDBC driver is built on a private protocol that existed in at least 8.0, so I'd expect all 8x versions to support JDBC, more or less.
http://www.oracle.com/technology/tech/java/sqlj_jdbc/htdocs/jdbc_faq.html
http://www.oracle.com/technology/sample_code/tech/java/sqlj_jdbc/index.html
http://www.oracle.com/technology/software/tech/java/sqlj_jdbc/index.html
However, you may want to consider using a newer version of the Oracle database; you can download the latest, and a single-user-for-development-only license is free.
http://www.oracle.com/technology/software/products/database/oracle10g/index.html

Packet Capture for VPN traffic

Hi Team,
Please help me to set ACL and capture for Remote Access VPN traffic.
Requirement is to see how much traffic is flowing from that Source IP.
Source : Remote Access VPN IP(Tunneled) 10.10.10.10
Destination : any
This is what I did which is not working
access-list VPN extended permit tcp host 10.10.10.10 any
capture CAP_VPN type raw-data access-list VPN interface OUTSIDE

Hello,
If you set up the capture with that access list, you are filtering just TCP traffic, therefore you won't be able to see UDP or ICMP traffic too, I would recommend you using the same ACL, though using IP:
access-list VPN extended permit ip host 10.10.10.10 any
Capture CAP_VPN access-list VPN interface outside
Then with:
show capture CAP_VPN
You will be able to see the packet capture on the ASA, though you can export the capture to a packet sniffer as follow:
https://<ip address of asa>/capture/<capname>/pcap capname-->CAP
For further details of captures you can find it on this link
Let me know if you could get the information you were trying to reach.
Please don´t forget to rate and mark as correct the helpful Post!
David Castro,
Regards,

MTU EA6500 Packet Size Pinging

Trying to find out the optimum MTU setting so was pinging. The issue is I can not get any fragmentation. All packet sizes seem to ping successful without packet loss so I have no idea what the best MTU setting is?
Why can I not get pinging framentation?

http://www.dslreports.com/faq/5793

Do I need to open ports for my services if I am connecting through VPN

Hi,
I work in a small office and we are trying to connect people remotely to our server through VPN.
Using the Server App I managed to make VPN work and successfully connected to our file share points, so that means file sharing worked without opening ports for afp on my Airport router.
On the other side I cant connect to other services as iCal and Address Book as I am locally in the office. Does that mean I have to open the ports for those services on the router, if yes then why use VPN in the first place.
Thanks,

If I understood you correctly:
External client -> (server.domain.name) -> Router -> Server: is working
Internal client -> (server.domain.name) -> Router -> Server: is not working
Internal client -> (local ip) -> Server: is working
If yes, you can implement a-la "split zone DNS".
1. On the external DNS your domain name server.domain.name resolved to the external router IP.
2. You should add record (and zone) server.domain.name to your OS X Lion Server DNS pointing to local IP
When you are connected to VPN, system sets DNS server to your Lion server and server.domain.name is resolving to local IP.
When you are working without VPN, system use external DNS and server.domain.name is resolving to external IP.
Of course, you should open ports for your services on the router is you want to use them from external network.
I am using this configuration and it works perfectly.

Is Low MTU (ie 320) for VoIP over Frame-relay can be used to avoid serialization delay for large data packets?

In order to provide voice quality for VoIP, is FR fragmentation equivalent to lowering the MTU size for the serial subinterface of a Frame relay subinterface?
Is there any isues like stop communications, using Low MTU ?

If the router belongs to any of the
platform listed below, then use
FRF12 for you fragmentation. The MTU size
lowering also works but this can cause a high over
head as it can't be specified on a per dlci level.
With multiple dlci i.e. subinterfaces use per dlci fragmentation.. this helps reduce the overhead of changing the MTU size of the physical interface.
Snip config example.( __Must be configured on both side of the termination___)
PHONE 3333312---ROUTERA ----DLCI 100----ROUTERB ---PHONE 2111123
ROUTER A
dial-peer voice 1 voip
destination-pettern 2T
session target ipv4:10.10.10.2
int ser 0/0
encap frame-relay
frame-relay traffic-shaping
no ip address
interface serial0/0.1 point-to-point
ip add 10.10.10.1 255.255.255.252
frame-relay interface-dlci 100
class voice
map-class frame-relay voice
frame cir 64000
frame bc 640
frame mincir 64000
frame-relay ip rtp priority 16384 16383 48
frame fragment 80
frame fair-queue 64 256 0
ROUTER B
dial-peer voice 3 voip
destination-pettern 3T
session target ipv4:10.10.10.1
int ser 0/0
encap frame-relay
frame-relay traffic-shaping
no ip address
interface serial0/0.1 point-to-point
ip add 10.10.10.2 255.255.255.252
frame-relay interface-dlci 100
class voice
map-class frame-relay voice
frame cir 64000
frame bc 640
frame mincir 64000
frame-relay ip rtp priority 16384 16383 48
frame fragment 80
frame fair-queue 64 256 0
This should help if your router is
c2600, c3600, mc3810, c7200, c1750
all running the right level of IOS.
12.1(5)T and above should work well.

Controlling packet size from 32K to 4K for SQL DSN

I've been engaged by my SQL administrator to find out how the packet size can be reduced from 32K to 4K in the CF9 Enterprise environment in a multi-server configuration. Although it's not likely related to the version rather than the JDBC Drivers provided in the product, none the less there is no clear way of identifying where this could be changed within the ColdFusion DSN's. Does anybody have any insight on how to control the packet sizes in a SQL DSN i Coldfusion 9 or 9.0.1? Would be greatly appreciated.

If you are using MSSQL, open the CF administrator, goto the datasource, click the "Advanced Settings" button and enter in:
packetSize=8
within the Connection String textarea box then hit submit, there should be no need to restart anything
Connection details for the PacketSize property:
Valid Values
-1 | 0 | x
where x is an integer from 1 to 128 that represents a number of bytes.
If set to -1, the driver uses the maximum packet size that the database server accepts.
If set to 0, the driver uses the default packet size configured on the database server.
If set to x, the driver uses a packet size that is calculated using the specified value multiplied by 512.
Example
If PacketSize=8, the packet size is set to 8 * 512 bytes (4096 bytes).
Default
-1
Data Type
int
Microsoft recommends (4096 bytes)

The setting for packet size (RSCUSTV6)

HI Guys
i want to know the setting for packet size (RSCUSTV6). can i do in production . or dev.
i want change as
Packet size = 20000
FrequencyStatus-Idoc = 5
please advise on this.
Regards
siva

Hi Patel,
This will impact all the loads in the system as this wil change the parameters for all the loads.. And hence its always recommended to reduce the data packet size at the Infopackage level...
Also u can do the settings for the ODS Activation process as well using this RSCUSTV6 t-code.
Better chane it for the specific job.
thanks

Mtu & packet size for ssh & https through vpn

Similar Messages

Maybe you are looking for