Packet Transport and Fragmentation

If you use a GRE tunnel to connect your IPsec source with your remote destination, setting the don’t fragment (DF) bit in the IP datagram header is not enough to ensure transport of whole packets through the GRE tunnel required as part of the CNA VPN configuration.

The DF bit will become encapsulated in your IPsec GRE tunnel’s transport packet, and the GRE tunnel configured on the CNA system will never see it.

You should set the maximum transfer size (MTU) in your IPsec configuration small enough so that total IP packet size, including internal headers plus the CNA GRE tunnel header, will never exceed the IP protocol packet maximum of 1500 bytes.

For example, if your IPsec system uses the Encapsulating Security Payload (ESP) protocol using the DES (Data Encryption Standard) or Triple-DES algorithm with the DF bit set, you should set the MTU to be no greater than 1414 bytes.

This number is derived as follows: the IP packet must contain your IPsec GRE header (24 bytes), the IP tunnel header (20 bytes), the ESP header (8 bytes), the ESP payload initialization vector (8 bytes), and the ESP trailer (2 bytes).

Subtracting from 1500, this produces a data payload of 1438 bytes, but the CNA-configured GRE tunnel takes 24 of those bytes for its own header, leaving you with 1414 bytes for MTU size.

If your IPsec system uses ESP plus authentication using MD5 (Message Digest) or SHA-1 (Secure Hash Algorithm), reserve another 12 bytes for the authentication integrity check value. This, plus an adjustment to align on a multiple of 8 bytes, produces an MTU of 1422. To allow for the 24-byte CNA GRE header, the final MTU in your IPsec configuration should be no greater than 1398.

If you use ESP plus the IP Authentication Header (AH) protocol, the math works out to 1414 bytes minus the 24-byte CNA GRE header, for a final configured MTU of no more than 1390 bytes.

Table 4 summarizes these maximum MTU sizes, that will ensure unfragmented passage of packets through the CNA GRE tunnel for common IPsec configurations:

If your IPsec implementation uses different encryption or authentication algorithms, look for variations in header sizes that must be accommodated within the IP packet.

If the final packet that transits the CNA GRE tunnel exceeds the IP packet maximum of 1500 bytes, the packet will be subject to fragmentation regardless of the setting of the DF bit. While this fragmentation will not cripple your VPN traffic, it will most likely degrade your network’s performance.