Request for information: Branch SDWAN ION to DC ION MTU

[RomainCouvreur]

Hello Live community,

Our customer is looking for following information:
Since a while they are looking to identify the MTU value between a Branch ION and a Datacenter ION.
This info cannot be retrieved via CLI or GUI.

The MTU between Branch ION and Prisma Access though, is configured by default on 1400, can be found within the GUI and CLI.
Nevertheless this is about the MTU between BRANCH and DC.

Reason: They notice different MTU's to be applied on different ISP.

Using EuroFiber
- Ping from the Branch PC to DC: 1472 (Branch ION > DC ION)
- Ping to Internet: 1372 (Branch ION > Prisma Access)

Using Orange
- Ping from the branch PC to DC: 1338  (Branch ION > DC ION)
- Ping to Internet: 1346 (Branch ION > Prisma Access)

Thanks in advance for your reply.

Best regards

[RomainCouvreur]

Hello Team,

Do you have any advice for us ?

Thank you and best regards.

[rgallagher]

The SD-WAN VPN interfaces have the same MTU as the parent interface, if the parent is 1500, then the VPN is 1500, the branch ION fragments after IPSEC encapsulation and the DC device does reassembly. For TCP traffic the ION will also do a MSS reset to MTU minus 200. From your outputs looks like you might have some MTU limitation in those carrier networks.

[nikoolayy1]

Better also use the latest version as in Addressed Issues in Prisma SD-WAN ION Release 5.6 I see bug with mtu bigger than 1376 when packet is fragmented. The ion device mtu is seen in advanced settings under the interface Configure Internet Ports but I am not aware of any mtu discovery for the ion devices, so as @rgallagher  focus on your providers and contact them.

[RomainCouvreur]

Hello Team,

Thank you for your feedback.

I will check with end customer and let you know if any question subsists or if we can close this discussion.

Best regards.