topic Re: Azure VPN Tunnel configuration MTU adjustment in General Topics

Azure VPN Tunnel configuration MTU adjustment

fatboy1607 — Tue, 06 Sep 2016 06:50:40 GMT

we are going to configure route based VPN with Azure , Do we need to adjust MTU on tunnel interface on Palo side.

Any specific recommendation.

Re: Azure VPN Tunnel configuration MTU adjustment

TranceforLife — Tue, 06 Sep 2016 07:04:06 GMT

Hi,

Azure....... I had a very long discussion here with this guy:

https://live.paloaltonetworks.com/t5/General-Topics/VPN-to-Azure-dropouts/m-p/98936#M44162

Make sure that the Palo in the passive mode, don't know why but ike1 is not stable if its disable. Anything specific let me know.

Thx,

Myky

Re: Azure VPN Tunnel configuration MTU adjustment

fatboy1607 — Tue, 06 Sep 2016 07:14:13 GMT

We are using ikev2 , not seeing any drops , I just want to understand best MTU size for tunnel interface or if there is any need to make changes to MTU size.

Re: Azure VPN Tunnel configuration MTU adjustment

mikand — Wed, 07 Sep 2016 18:05:17 GMT

I have asked in this kb but it seems like you should enable "Adjust TCP MSS" on the external physical interface to get optimal performance (and in your internal network makre sure you dont drop PMTU (path mtu discovery)):

https://live.paloaltonetworks.com/t5/Management-Articles/How-to-Improve-Performance-for-IPSec-Traffic/ta-p/53301