Configure a Maximum Transmission Unit (MTU) Value

The maximum transmission unit (MTU) specifies the largest data packet, measured in bytes, that a network can transmit.

In most cases, you can use the default MTU values on the Firebox:

  • For GRE-based virtual interfaces, the MTU is 1476 bytes.
  • For VTI-based virtual interfaces, the MTU is 1500 bytes.

In Fireware v12.5 or higher, you can specify a custom MTU value for BOVPN virtual interfaces. The MTU setting is specific to individual BOVPN virtual interfaces and is not a global Firebox setting.

You might need to specify a custom MTU value if your Firebox connects to a third-party VPN endpoint that drops packets that exceed a certain size. To determine whether the third-party endpoint requires a custom MTU value, see the documentation provided by the third-party vendor.

MTU Requirement for Microsoft Azure VPNs

For Azure VPN connections, Microsoft requires a MTU of 1400 or a TCP MSS of 1350. The Azure VPN gateway drops packets with a total packet size larger than 1400.

If the Azure VPN gateway drops packets from your Firebox, we recommend these Firebox settings:

  • Fireware v12.5 or higher — In the BOVPN virtual interface configuration, specify an MTU of 1400.
  • Fireware v12.4.1 or lower — In the physical interface configuration, specify an MTU of 1400.

As an alternative, you can set the global TCP MSS value to 1350. However, we do not recommend this option because this setting affects other Firebox interfaces and applies only to TCP traffic. For example, this setting does not apply to RDP traffic in most cases because RDP usually uses UDP. If you use RDP to access servers hosted in Azure, Azure will drop packets larger than 1400 bytes even if you specify the recommended TCP MSS value. For more information about the TCP MSS setting, see Define Firebox Global Settings.

Configure an MTU

You must use the CLI to configure the MTU setting.

Use this command:

diagnose vpn "/ipsec/vif/mtu/set \“[interface_name]\" [MTU]"

For example, to change the MTU for the interface BovpnVif.1 to 1400, specify:

diagnose vpn "/ipsec/vif/mtu/set \"BovpnVif.1\" 1400"

See Also

About BOVPN Virtual Interfaces

Configure a BOVPN Virtual Interface