Resolve IPv4 Fragmentation, MTU, MSS, and PMTUD Issues with GRE and IPsec

Publisher

Cisco Systems

URL

https://www.cisco.com/c/en/us/support/docs/ip/generic-routing-encapsulation-gre/25885-pmtud-ipfrag.html

Published

2023-05-17

Updated

unknown

Accessed

2026-10-02

HTTP status

200

License

Cisco documentation terms; no-redistribution; short excerpts and locators only

Source notes citing this source

• Because MSS clamping rewrites only TCP SYN options, it cannot stop a SIP-over-UDP INVITE larger than the tunnel MTU from being fragmented; it helps SIP only after signalling moves to TCP or TLS. inferred in context
• Cisco documents that ip tcp adjust-mss works by reducing the MSS value carried in TCP SYN packets. in context
• Cisco states that GRE encapsulation adds 24 bytes to a packet. in context
• Cisco recommends setting the GRE tunnel IP MTU to 1400 bytes when GRE is combined with IPsec, to absorb both overheads. in context
• Cisco notes that PMTUD depends on ICMP Destination Unreachable type 3 code 4 messages and that filters which block all ICMP types break it. in context
• Cisco states that IPsec adds at least one IPv4 header and that ESP with ESP authentication overhead does not exceed roughly 58 bytes. in context

Cite this source record

APA

WarmTransfer. (2023, May 17). Resolve IPv4 Fragmentation, MTU, MSS, and PMTUD Issues with GRE and IPsec. WarmTransfer. https://warmtransfer.net/knowledge/sources/cisco-docs-25885-pmtud-ipfrag

BibTeX

@misc{warmtransfer-cisco-docs-25885-pmtud-ipfrag,
  title  = {Resolve IPv4 Fragmentation, MTU, MSS, and PMTUD Issues with GRE and IPsec},
  author = {{WarmTransfer}},
  year   = {2023},
  url    = {https://warmtransfer.net/knowledge/sources/cisco-docs-25885-pmtud-ipfrag},
  note   = {Cisco Systems, accessed 2026-10-02}
}