Community discussions

MikroTik App
 
jparkerresgen
just joined
Topic Author
Posts: 4
Joined: Thu Dec 13, 2018 7:10 pm

IPSec fragmentation issue

Thu Dec 13, 2018 7:34 pm

I know this has been mentioned before, but I could not find a solution to the problem I am facing and so far Mikrotik support has not helped at all. Here is what I have.
(office) - (ISP) - (Internet) - (ISP) - (RouterOS) - (IPSec to Google over peering connection) - (RouterOS) - (Webserver)

Packets over 1350 bytes cannot go over that IPSec tunnel so I set MSS accordingly (Current set to 1200 as part of testing). This doesn't avoid the fragmentation issue as the webserver seems to ignore the MSS and sends packets that get fragmented later on. This is shown in packet captures. I even set MSS on the web server to 1200 and confirmed that is what it sends in the SYN packets, but it still sends larger packets that get fragmented at the RouterOS system in Google. This is a problem as I can only get about 10 requests/second over that link at about 7000ms latency. I can't find any other reason for the slowness and when testing with iperf I can get about 800Mbps.

Can anyone point me in the right direction on finding the cause?
 
User avatar
sebastia
Forum Guru
Forum Guru
Posts: 1782
Joined: Tue Oct 12, 2010 3:23 am
Location: Antwerp, BE

Re: IPSec fragmentation issue

Sun Dec 16, 2018 12:27 pm

MTU is os-level configuration at the webserver. Make sure you follow os specific instructions to configure that.

Who is online

Users browsing this forum: Bing [Bot] and 100 guests