SRX Services Gateway
Highlighted
SRX Services Gateway

VPN over Cisco GRE tunnel issue(s)

[ Edited ]
‎11-21-2018 09:24 AM

OK, I realise vital info may be missing, but here's what we have setup:

 

LAN1 -- SRX1 -- IPSEC VPN -- ||| -- CISCO1 -- GRE -- MPLS -- GRE -- CISCO2 -- ||| -- IPSECVPN -- SRX2 -- LAN2

 

Our network is either side of the Cisco routers. The bit in the middle is provided by a 3rd party. We use OSPF for routing. There are no specific MTU in place on any device.

 

At present our IPSEC VPN tunnel will only come up if there is a static route in place on SRX2 telling it how to get to CISCO1 via a local interface. CISCO2 is unable to form an OSPF adajency, whereas CISCO1 is. When the tunnel is up, it is not 'reliable' i.e. as soon as any load is paased over it pings start dropping, file transfers won't complete and all sorts of fragmentation is seen on the Cisco routers, which I think points to an MTU issue. The third party has tried setting an interface MTU of 1420 at both ends, which we've matched on our SRX devices, but this causes our IPSEC tunnel to drop and stay down. We've also tried setting the VPN MTU at 1420, but with no success either.  The media type connected to CISCO1 is fibre, and at CISCO2 VDSL.

 

Does anyone have any experience of this kind of issue or suggestions as to how we might solve it?

7 REPLIES 7
SRX Services Gateway

Re: VPN over Cisco GRE tunnel issue(s)

‎11-21-2018 11:02 PM

Hi,

My suggestion is that first find out the working mtu without fragmentation between SRX1 and SRX and then set the MTU of the st0 interface to 112 bytes less than working mtu

 

from srx1:

ping <srx2> do-not-fragment size < different size>

Thanks,
Nellikka
JNCIE x3 (SEC #321; SP #2839; ENT #790)
Please Mark My Solution Accepted if it Helped, Kudos are Appreciated too!!!
SRX Services Gateway

Re: VPN over Cisco GRE tunnel issue(s)

[ Edited ]
‎11-22-2018 12:41 AM

Thank you so much for getting back to me Nellikka.

 

Here are the results, assuming I have done it correctly. 192.168.50.254 is ge-0/0/0 on SRX2.

 

> ping 192.168.50.254 do-not-fragment size 9161
PING 192.168.50.254 (192.168.50.254): 9161 data bytes
36 bytes from 172.16.0.74: frag needed and DF set (MTU 9188)
Vr HL TOS  Len   ID Flg  off TTL Pro  cks      Src      Dst
 4  5  00 23e5 ec04   2 0000  40  01 8b13 172.16.0.73  192.168.50.254

> ping 192.168.50.254 do-not-fragment size 9160
PING 192.168.50.254 (192.168.50.254): 9160 data bytes
9168 bytes from 192.168.50.254: icmp_seq=0 ttl=64 time=117.111 ms

 

So, given your instructions should I be setting the MTU on the st interface at both ends to 9048? I have tried this setting and unfortunately it hasn't helped.

SRX Services Gateway

Re: VPN over Cisco GRE tunnel issue(s)

‎11-22-2018 12:55 AM

Hi,

Yes, set the mtu to 9048 at both ends.

I hope the command output is from SRX1. Based on the output jumbo frame is supported on all devices between SRX1 and SRX2.

Thanks,
Nellikka
JNCIE x3 (SEC #321; SP #2839; ENT #790)
Please Mark My Solution Accepted if it Helped, Kudos are Appreciated too!!!
SRX Services Gateway

Re: VPN over Cisco GRE tunnel issue(s)

‎11-22-2018 02:58 AM

Hi Nellikka. Unfortunately, as mentioned above, 9048 did not resolve the issue Smiley Sad

SRX Services Gateway

Re: VPN over Cisco GRE tunnel issue(s)

‎11-22-2018 03:06 AM

Hi,

Could you tell me what is working and not working? I hope you configured ospf on st0 interfraces and it is working. Please share the steps of the testing and possible its outputs

 

Thanks,
Nellikka
JNCIE x3 (SEC #321; SP #2839; ENT #790)
Please Mark My Solution Accepted if it Helped, Kudos are Appreciated too!!!
SRX Services Gateway

Re: VPN over Cisco GRE tunnel issue(s)

‎11-22-2018 04:42 AM

 

I'm not sure how to properly answer that question. The tunnel is up, it does pass traffic, but not reliably as described in my OP. I have tried various MTUs on both the physical and the ST interfaces. I've aslo tried setting the MSS value for the VPN. Furthermore, I have tried setting the df-bit as clear and copy. OSPF is set on the ST interfaces and appears to be working,

SRX Services Gateway

Re: VPN over Cisco GRE tunnel issue(s)

‎11-22-2018 04:54 AM

Hi,

Try to ping the srx2 st0 interface ip from srx1 and find out working mtu. what is the size of the file you are transferring? And find out the MSS value in the tcp handshake from client and server packet capture.  If the MSS value is higher that st0 working MTU, set mss value less than that in both srx

 

set security flow tcp-mss all-tcp < ..>

Thanks,
Nellikka
JNCIE x3 (SEC #321; SP #2839; ENT #790)
Please Mark My Solution Accepted if it Helped, Kudos are Appreciated too!!!