Hello,
How does AutoMTU (Actual MTU) work for VPN tunnels?
For example: i have gre+ipsec tunnels sha1/aes-128 ctr
CCR1009(AMTU1446)----(AMTU1434)RB3011
CCR1009(AMTU1446)----(AMTU1434)hAPac2
Why MTU is different on both sides?
Any ideas?
6.47.8 still have this issue!
finally, two years later, I got the right answer from tech support.
but first read the story and appreciate how much effort and time it took me to get this answer:
23/12/2019
Actual MTU on VPN tunnels
Hello,
How does AutoMTU (Actual MTU) work for VPN tunnels?
For example: i have gre+ipsec tunnels sha1/aes-128 ctr
CCR1009(AMTU1446)----(AMTU1434)RB3011
CCR1009(AMTU1446)----(AMTU1434)hAPac2
Why MTU is different on both sides?
23/12/2019
MikroTik support #[SUP-4418]: Actual MTU on VPN tunnels
Thank you for writing to MikroTik Support, this is an automated reply.
We will try to help you as soon as possible (reply might take up to 3 business days).
02/01/2020
Hello,
3 days have already passed
07/01/2020
Hello,
The MTU is automatically calculated based on the parent interface and the maximum frame size that can be sent between the routers without fragmentation. Do you have regular ethernet-like connectivity on both ends with MTU of 1500?
Emīls Z.
07/01/2020
On both ends ethernet interfaces have MTU and AMTU = 1500:
screenshots
15/01/2020
Hello,
It is possible that something in-between has lower MTU than 1500. Have you tried running ping between the routers with size=1500 and do-not-fragment bit set?
Emīls Z.
16/01/2020
screenshots
03/02/2020
Hello,
Unfortunately I am unable to reproduce the described issue, could you please send us the supout.rif files from all the involved devices? <--------- lie lie
This article explains how to make a supout.rif file:
https://wiki.mikrotik.com/wiki/Manual:Support_Output_File
Emīls Z.
03/02/2020
supout.zip
10/03/2020
Hello
There is only a single supout file in this zip archive.
Best regards
Mārtiņš S.
10/03/2020
Yes, this is supout from router with incorrect tunnel MTU.
10/03/2020
Hello
Provide supout files from both end points.
Best regards
Mārtiņš S.
11/03/2020
2supout
11/03/2020
Hello
Try to ping both endpoints from each end with a do-not-fragment flag. A to B and B to A, and/or run a traceroute. Most likely devices reach each other through different paths resulting in different MTU values.
Best regards
Mārtiņš S.
11/03/2020
I already sent you the ping results 16.01.2020
screenshot
11/03/2020
Ping goes to x.x.x.x, but GRE in supout file is established to x.x.x.x, there is no x.x.x.x address.
Mārtiņš S.
11/03/2020
screenshot
12/03/2020
Hello
Please provide full remote access to both of the routers.
Best regards
Mārtiņš S.
12/03/2020
What for? You already have the config of our router.
You can reproduce this in your laboratory. All our RB3011 and hAPac2 affected by this problem. It does not depend of the configuration, but only of the model of the router.
13/03/2020
Hello
This is not a common issue and we cannot reproduce this in the lab. <----- lie lie
Best regards
Mārtiņš S.
13/03/2020
Why are you lying to me?
This problem is easily reproduced even on a local network.
I took brand new hEX and hAPac2, and connect in same LAN to CCR1009 via gre tunnel (gre+ipsec aes-ctr 128 sha1).
On hEX tunnel get actual MTU =1446
On hAPac2 tunnel get actual MTU=1434
16/03/2020
Hello
Here is an example:
*preview of screenshot which I cannot see *
Best regards
Mārtiņš S.
…
I understand that I would not get the right answer from him
after a while I created a new ticket
SUP-63178
14/10/2021
Hello,
I use GRE tunnels+IPsec (aes-128 ctr/sha1). WAN Path MTU always =1500 in all cases.
On most routers (CHR, CCR, hEX) gre-tunnel show “Actual MTU“=1446.
But on all RB3011 routers gre-tunnel show “Actual MTU“=1434.
Why is the “Actual MTU” value less on the RB3011 routers?
Olga Ļ.20/Oct/21 10:10 AM
Hello,
MTU on RB3011 should not be less in same circumstances.
Please send us the supout.rif file from your devices, one from RB3011 and another from another device with same interface configuration but different MTU.
This article explains how to make a supout.rif file:
https://help.mikrotik.com/docs/display/ROS/Supout.rif
22/10/2021
this issue can be easily reproduced even on directly connected routers:
screenshots
supouts
Olga Ļ.25/Oct/21 8:40 AM
Hello!
Can you please swap these routerboards and try again? (To connect hex ether3 where currently RB3011 ether3 is connected and RB3011 to hex previous place).
Olga Ļ.25/Oct/21 9:11 AM
Hello!
Sorry, we re-checked the information. MTU on RB3011 differs due to crypto driver.
You can set MTU manually on second side:
interface/gre/set gre-tunnel1 mtu=1434
…
why is MT techsupport so bad? Why is MT techsupport lying?
That was indeed a ordeal. I noticed that in the first posting also the AC2 also suffered to a lower MTU.
Does it means that all ARM32 have this problem?
25/10/2021
Does this issue affect all routers on the ARM?
Will this issue be fixed in ROS 7?
Olga Ļ. 25/Oct/21
Hello!
Such behavior is on part of ARM and ARM 64 boards.
It is expected behavior, it will not be changed in ROS 7.