topic Request for information: Branch SDWAN ION to DC ION MTU in Prisma SD-WAN Discussions

Request for information: Branch SDWAN ION to DC ION MTU

RomainCouvreur — Tue, 11 Mar 2025 11:13:50 GMT

Hello Live community,

Our customer is looking for following information:
Since a while they are looking to identify the MTU value between a Branch ION and a Datacenter ION.
This info cannot be retrieved via CLI or GUI.

The MTU between Branch ION and Prisma Access though, is configured by default on 1400, can be found within the GUI and CLI.
Nevertheless this is about the MTU between BRANCH and DC.

Reason: They notice different MTU's to be applied on different ISP.

Using EuroFiber
- Ping from the Branch PC to DC: 1472 (Branch ION > DC ION)
- Ping to Internet: 1372 (Branch ION > Prisma Access)

Using Orange
- Ping from the branch PC to DC: 1338 (Branch ION > DC ION)
- Ping to Internet: 1346 (Branch ION > Prisma Access)

Thanks in advance for your reply.

Best regards

Re: Request for information: Branch SDWAN ION to DC ION MTU

RomainCouvreur — Thu, 13 Mar 2025 08:38:55 GMT

Hello Team,

Do you have any advice for us ?

Thank you and best regards.

Re: Request for information: Branch SDWAN ION to DC ION MTU

rgallagher — Thu, 13 Mar 2025 12:11:15 GMT

The SD-WAN VPN interfaces have the same MTU as the parent interface, if the parent is 1500, then the VPN is 1500, the branch ION fragments after IPSEC encapsulation and the DC device does reassembly. For TCP traffic the ION will also do a MSS reset to MTU minus 200. From your outputs looks like you might have some MTU limitation in those carrier networks.

Re: Request for information: Branch SDWAN ION to DC ION MTU

nikoolayy1 — Sat, 15 Mar 2025 11:04:51 GMT

Better also use the latest version as in Addressed Issues in Prisma SD-WAN ION Release 5.6 I see bug with mtu bigger than 1376 when packet is fragmented. The ion device mtu is seen in advanced settings under the interface Configure Internet Ports but I am not aware of any mtu discovery for the ion devices, so as @rgallagher focus on your providers and contact them.

Re: Request for information: Branch SDWAN ION to DC ION MTU

RomainCouvreur — Mon, 17 Mar 2025 08:39:36 GMT

Hello Team,

Thank you for your feedback.

I will check with end customer and let you know if any question subsists or if we can close this discussion.

Best regards.

Re: Request for information: Branch SDWAN ION to DC ION MTU

RomainCouvreur — Tue, 25 Mar 2025 08:45:49 GMT

Hi Team,

Thank you for your feedback.

End customer will contact his provider to correct it and we will install the last Prisma SDWAN version to be up to date.

Thanks again for your assistance on this matter.

Best regards.