Setup involving Palo Alto SD-WAN and Cisco FlexConnect APs, understanding the tunnel MTU behaviour

pritam.singha — Thu, 13 Mar 2025 04:25:42 GMT

We are currently planning a Cisco FlexConnect wireless AP setup with Palo Alto SD-WAN. as per various reference guides, we observed that when Windows performs certificate-based authentication, it sends large packets with an MTU of 1482 or more. However, the Palo Alto sdwan tunnel size is set to 1432.

This raises a concern: when EAP packets are sent from the AP (Branch) to the WLC (HQ) over the SD-WAN, and they traverse the Palo Alto firewall, the packets may get fragmented. To avoid this, we need to explore optimization options on either the firewall or the SD-WAN side to ensure the EAP packets reach the WLC without fragmentation.

Key Questions:

What optimizations can be implemented on the firewall or SD-WAN to prevent EAP packet fragmentation?
Are there any firewall rule changes required to accommodate this?
Or even after the fragmentation what are the major issues we might face in such setup.

For additional context, please refer to the attached image.

Re: Setup involving Palo Alto SD-WAN and Cisco FlexConnect APs, understanding the tunnel MTU behaviour

BrewCity34 — Mon, 21 Apr 2025 21:02:22 GMT

We are running Flexconnect AP's in our branches and I'm not aware of any issues with authentication.

topic Setup involving Palo Alto SD-WAN and Cisco FlexConnect APs, understanding the tunnel MTU behaviour in Prisma SD-WAN Discussions

Setup involving Palo Alto SD-WAN and Cisco FlexConnect APs, understanding the tunnel MTU behaviour

Re: Setup involving Palo Alto SD-WAN and Cisco FlexConnect APs, understanding the tunnel MTU behaviour