A police records bureau sees large civic GIS file transfers stall across DMVPN because IPsec-plus-GRE overhead shrinks effective path MTU. What tuning most directly addresses the symptom?
Select an answer to reveal the explanation.
Short Explanation
Crypto and GRE eat header room, so elephant GIS flows bounce off invisible walls. Dial the tunnel MTU down and clamp TCP MSS so packets fit the real pipe—don’t pretend the Internet is a jumbo playground.
Full Explanation
GRE plus ESP overhead reduces the maximum payload that survives the underlay path MTU. Setting an appropriate tunnel IP MTU and TCP MSS clamping prevents endpoints from sending oversized segments that are dropped when DF is set and ICMP fragmentation-needed is filtered. Clearing IPsec or changing unrelated access VLANs does not correctly solve overhead-aware path sizing on DMVPN.