topic Re: VPN, Jumboframes on IPSEC in Firewall and Security Management

VPN, Jumboframes on IPSEC

vinceneil666 — Fri, 14 Jan 2022 12:57:32 GMT

Hi,

For a backbone fully supporting jumboframes, have anyone any experience building a site2site vpn utilizing jumboframes ? I would assume it comes down to using VTI interfaces and just setting the MTU there... and ofcourse, onn all other interfaces to.

Re: VPN, Jumboframes on IPSEC

the_rock — Fri, 14 Jan 2022 13:42:25 GMT

Thats a KEY thing here...MTU size.

Re: VPN, Jumboframes on IPSEC

vinceneil666 — Fri, 14 Jan 2022 14:15:43 GMT

yeah ...I know... eh ?

Re: VPN, Jumboframes on IPSEC

the_rock — Fri, 14 Jan 2022 14:22:36 GMT

Put it this way...higher MTU will simply mean that every packet will carry much more data, BUT, there is way higher possibility that packets will be fragmented, so at the end of the day, its really a question speeds vs reliability/efficiency.

Re: VPN, Jumboframes on IPSEC

vinceneil666 — Fri, 14 Jan 2022 14:41:47 GMT

I know these things 🙂 ... I was simply just wondering if anyone had any experience on setting this up on Check Point. But it will probably be okay just setting the right MTU on all involved interfaces.

Re: VPN, Jumboframes on IPSEC

the_rock — Fri, 14 Jan 2022 14:43:30 GMT

Im glad you asked, because I have set it up and also helped customers do it and it does work. Is it recommended, thats whole another story... : - )

Re: VPN, Jumboframes on IPSEC

Timothy_Hall — Sat, 15 Jan 2022 18:42:27 GMT

Assuming you have control of every MTU setting in the network path and can set them identically it should work fine. However should any of these MTUs in the path revert to a default or get accidentally lowered you will be severely punished with terrible performance caused by roughly 50% packet loss due to the inability to fragment IPSec. As a proactive step, I'd strongly advise making sure all the firewalls involved will accept an ICMP Destination Unreachable Code 4 (Frag needed) from any source which MIGHT allow you to escape this fate should it occur.

Re: VPN, Jumboframes on IPSEC

RamGuy239 — Mon, 17 Jan 2022 10:50:28 GMT

@Timothy_Hall

ICMP Destination Unreachable Code 4 (Frag needed). With Jumbo Frames / MTU 9216 in every direction, I suppose there should be an src: any, dst: any rule to allow for this? What services will cover Code 4? Do we have to use "dest-unreach"? It claims to be ICMP type 3 so I suppose it's the correct one?

Re: VPN, Jumboframes on IPSEC

Timothy_Hall — Mon, 17 Jan 2022 12:56:16 GMT

The existing dest-unreach ICMP service will work, or you could create a more specific one like this:

Re: VPN, Jumboframes on IPSEC

RamGuy239 — Mon, 17 Jan 2022 13:15:26 GMT

@Timothy_Hall

Wonderful!