Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I am currently troubleshooting an issue where some users on Windows 7 and XP systems cannot access an SSL website on our network. The same site works fine on our servers (Server 2003, completely up-to-date, and a Ubuntu Server box) and all of our OSX machines. Our gateway is a machine running ISA 2003, which provides firewall and NAT services to the network.

So far I have narrowed it down to an MTU issue - when I force a Windows 7 box to an MTU of 1100 (for example) the site works fine, but when I change the MTU back up to 1500, the site refuses to load. When doing a "ping test" with "Don't Fragment" and a specific size specified, the MTU can be determined - but it has also changed several times over the past few hours...

At the networking level, when the site refuses to load the remote server sends a TCP reset directly after (or very close to the end of) the SSL handshake.

Is there a way to force an MTU for a specific IP address? Alternatively, is there any explanation for this behaviour (perhaps a method for verifying automatic path MTU discovery is working)?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

is this site remote? Does it use a site to site VPN tunnel? Many vpn tunnels you have to change the MTU, since the overhead of the tunnel packets. I have seen similar issues when sites have a GRE or IPSEC tunnel. In fact, one we didn't even know it was there, but apparently, the office used 2 different floors on a building, separated by a dozen others, and the building wouldn't let them run their own network, they had to use the buildings "public" one, so someone in networking setup a tunnel between the two routers.

share|improve this answer
    
Yes, the site is remote. I'm not sure if they are using any sort of VPN tunnel, it may be worth contacting them to find out. Thanks. –  Matthew Iselin Mar 21 '11 at 4:10
    
+1. I have seen this exact issue many many times, and it has always been on remote sites running through VPN/Encryption tunnels. –  Hyppy Mar 21 '11 at 4:18
    
Late reply, been quite busy. They have PMTU disabled but we've also noticed sometimes the site fails to load even with a VERY low MTU. I'll ask a new question with the new information we have and accept yours (as I feel it is correct for the symptoms I outlined in my question). Cheers! –  Matthew Iselin May 3 '11 at 1:11

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.