juan_battaglino

New Member

Solved

GRE Tunnel - MTU packet size

4 replies
14809 views

Hi everybody! Just a short question. A customer is asking us if it is possible to change the size of the mtu packets to 1500 in a gre tunnel. As far as I know, there's an overhead at the beginning of these packets depending the type of encryption used, so it wouldn't be possible to do this. Am I right?

Thanks in advance.

localhostAnswer

Visitor III

Exactly!

Apparently the FG even does a sanity check for you :).

GRE over IPv4 has an overhead of IPv4 (20 bytes) and GRE (4 bytes). Makes a maximum tunnel MTU of 1476.

MTU gets even smaller if over you are tunneling over an IPSEC tunnel.

juan_battaglinoAuthor

New Member

Anyone please?

Visitor III

Depends on the underlying interface.

But most likely it's <=1500. So then 1500 is too big for the GRE Tunnel.

juan_battaglinoAuthor

New Member

Thanks for you answer! When we try to set the size to 1500, we get this error message:

FORTI # set mtu 1500

MTU size not valid. Should be in the range of 68 - 1476.

node_check_object fail! for mtu 1500

value parse error before '1500'

Command fail. Return code -2

So in fact, you can't configure it to 1500 because it adds an overhead to these packets?

Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.

Thought Leadership. Security Summit. Thursday, October 8th. Disney's Grand Californian Hotel & SPA, Anaheim, CA.

Security Operations Summit: Modernize SecOps. Operate AI-Native.AMER: November 4 | 9:00 AM PST. India and SAARC: November 5 | 10:00 AM IST. EMEA: November 5 | 10:30 AM CET. APAC: November 5 | 11:00 AM SGT