A police records bureau sees large civic GIS file transfers stall across DMVPN because IPsec-plus-GRE overhead shrinks effective path MTU. What tuning most directly addresses the symptom?
Select an answer to reveal the explanation.
Short Explanation
Crypto and GRE eat header room, so elephant GIS flows bounce off invisible walls. Dial the tunnel MTU down and clamp TCP MSS so packets fit the real pipe—don’t pretend the Internet is a jumbo playground.
Full Explanation
GRE plus ESP overhead reduces the maximum payload that survives the underlay path MTU. When police-records GIS transfers stall across DMVPN, lowering tunnel IP MTU and/or clamping TCP MSS so large sessions fit within IPsec and GRE overhead directly addresses black-hole fragmentation when DF is set and ICMP fragmentation-needed is filtered.
Raising the underlay interface MTU above 9000 and disabling TCP on spokes does not fix Internet path MTU realities and breaks applications. Converting tunnels from IPsec to cleartext GRE eliminates encryption rather than sizing for overhead. Enabling jumbo frames solely on an access-layer printer VLAN does not help WAN tunnel overhead for GIS flows.
Exam caveat: tunnel MTU/MSS clamp is the standard fix for crypto+GRE stalls—do not remove IPsec to “make MTU easier.”
Operational check: set tunnel MTU and ip tcp adjust-mss appropriately, retest large GIS transfers, confirm no silent black holes, and keep IPsec enabled for records-bureau confidentiality. For civic operations, record the chosen control and the rejected alternatives in the change record so future on-call engineers understand which failure modes were avoided for citizen-facing services.