Question : MTU problems with VPN

Hi,

I want to connect two offices using VPN on Microsoft Windows 2000. The installation is not the problem; we had this set up and working in just a few hours.
However, when I connect to a POP3 server using a telnet client talking raw POP3 protocol I found that a packet is dropped silently when i send the LIST command. When there are a lot of messages in the inbox the response is not received.

I've tried a router-to-router solution without using VPN. The same problem occured with that solution. After hours and hours of debugging, reading and testing I found that the problem lies in the MTU. I made a few changes in the MTU settings and it worked! :)
The router-to-router solution is not encrypted. As soon as I add encryption OR use VPN the same problem happens again. I guess it is again the MTU, but this time I really can't figure it out.

Here is how the network looks like:

Internet -- InetGateway (192.168.1.100) -- Office1 (192.168.1.*) -- W2kGateway1 (192.168.1.1) --(WIFI Connection)-- W2kGateway2 (192.168.2.1) -- Office2 (192.168.2.*)

One more important thing: Both Windows 2000 gateways have 2 NIC's. One is configured and connected to the office LAN, the other is configured in a seperate subnet (10.0.0.*) and connected to the other gateway by a wireless connection.

Could anyone explain to me which adapter needs which MTU value? And what is "RAS MTU" and do I need to set this? (I found this option with DrTCP)

Help would really be appreciated, I can't figure it out ... Thanks in advance.

Answer : MTU problems with VPN

Usually, f the there are MTU problems due to a VPN, it will be n the internet traffic, not the internal traffic.  The VPN needs to take all your "regular" packets, encrypt them, and wrap them inside a new packet that is sent to the VPN server.  The VPN server then unwraps the packets, and retransmits them to the original IP address your application was trying to reach.  This typically results in the original packet eing broken up, because the original packet is too large to add all the VPN wrappering withou breakin the basic MTU limit.  The re-assembly effectively sends "fragmented packets," as if the packets had reached a router whose MTU was smaller than what you were sending.  Some VPNs are better than others at maintaining large packet caches, and reasembling the core packets as unfragmented units.

To ensre this does not happen at all, you have to drop your PC MTU to a size that is normal MTU minus maximum VPN per-packet overhead - which consists of teh ful size of a standard IP packet, plus encryption information.  Sometimes, you also have to do this on the internal servers, so that they will never send a frgamenting packet back to you; this is usually NOT a problem.

RAS MTU = Remote Access Services Maximum Transmission Unit, which is basically teh MTU for dial-up traffic.