lowering mtu on remote access vpn?

[flwsterN]

Hello i was wondering if its possible to lower the mtu on the remote access client endpoint vpn or the gw?

In my homelab i have built this MPLS network (in the cloud) that  is the connection between my home + and summer house. It runs wireguard + gre in the bottom so the maximum mtu of a packet cannot go over 1380 mtu and with ipsec on top of that i think the mtu has to go down to like 1280-1300 on that ipsec tunnel is it possible to configure that on a Checkpoint? Cant find anything on it.

Best regards,

BW

[PhoneBoy]

You can adjust the MTU of VPN traffic by setting the MSS size for VPN traffic.
See: https://support.checkpoint.com/results/sk/sk101219 

[the_rock]

You can change MTU on relevant interface from clich -> set interface ethxx mtu and then whatever size needed.

Then save config to save the setting.

Andy

[flwsterN]

Hello sorry late reply it seemed it was never a mtu problem (im doing mtu mss outside checkpoint) i had to open up ports 500 and 4500 but its wierd it always worked from my iphone which also says its using ipsec. Or does the iphone do it over 443?

Everything works fine now doing ipsec on top of wireguard + gre 🙂

[PhoneBoy]

Our VPN clients require a connection over HTTPS (TCP/443) to start the connection.
In some cases, this will also be used for the actual VPN transport (so called "Visitor Mode").

[the_rock]

Hey @flwsterN 

Any luck with this?

Andy

[flwsterN · Accepted solution]

Hello sorry late reply it seemed it was never a mtu problem (im doing mtu mss outside checkpoint) i had to open up ports 500 and 4500 but its wierd it always worked from my iphone which also says its using ipsec. Or does the iphone do it over 443?

Everything works fine now doing ipsec on top of wireguard + gre 🙂 however im just thinking of route leak ipsec traffic outside wireguard between the sites. 

[the_rock]

Port 443 is always needed for remote access. Check out below post about it.

Andy

https://community.checkpoint.com/t5/Remote-Access-VPN/Remote-access-without-visitor-mode-enabled/td-...

[flwsterN]

Yes but why is it working without opening 4500/500 when coming from Iphone vs mac/windows?

[the_rock]

I believe iphone would need only udp port 500, not udp 4500.

Andy