topic Re: Global Protect MTU setting overwritten in General Topics

Global Protect MTU setting overwritten

ChrisCon — Mon, 21 Mar 2022 14:35:37 GMT

Trying to set MTU for my GlobalProtect client.
I've found some information about this in Palo Alto docs.
I could not set it with netsh, I think it is because of GPO.
But I could set it with the PowerShell command: SET-NetIPInterface -InterfaceIndex 3 -NlMtuBytes 1300
When looking in the registry I see now MTU 1300 on the interface to which is assigned to PANGP Virtual Adapter.
But it seems that this setting is overwritten when establishing a VPN-connection.

I see this in the PanGPS.log:
(P6400-T4696)Debug(4561): 03/21/22 11:53:37:876 Try to set VA idx 3 MTU to 1400.
(P6400-T4696)Debug(4580): 03/21/22 11:53:37:876 set MTU: Found VA 3-IPv4-1300, set MTU to 1400.
(P6400-T4696)Debug(4590): 03/21/22 11:53:37:877 set VA MTU IPv4 to 1400 success
(P6400-T4696)Debug(4580): 03/21/22 11:53:37:877 set MTU: Found VA 3-IPv6-1300, set MTU to 1400.
(P6400-T4696)Debug(4590): 03/21/22 11:53:37:877 set VA MTU IPv6 to 1400 success

Do I really have to set the MTU in the Panorama-Settings?
I just want to change MTU for specific client.

Thanks.

Re: Global Protect MTU setting overwritten

kiwi — Thu, 24 Mar 2022 09:14:15 GMT

Hi @ChrisCon ,

As far as I know you can't set it for a specific client:

Configurable Maximum Transmission Unit for GlobalProtect Connections

Cheers,

-Kiwi.

Re: Global Protect MTU setting overwritten

BPry — Fri, 25 Mar 2022 00:54:40 GMT

@ChrisCon,

Part of the setup process for GlobalProtect is going to override whatever interface changes you made before establishing the tunnel. If I recall properly from long-ago threads, you would need to modify this post connection at the interface every single time you establish a connection.