A clinic's IOS XE tunnel to an AWS virtual private gateway is up, IKE and IPsec SAs look healthy, and ping to a VPC host works. Large TCP transfers hang. What should the engineer adjust on the tunnel?
Select an answer to reveal the explanation.
Short Explanation
Small ping packets slip through a doorway that a full-size TCP segment cannot. Since the tunnel and security associations are healthy, clamp TCP MSS on the tunnel interface so TCP sessions fit under the IPsec overhead. The BGP hold timer, OSPF dead interval, and SD-WAN BFD hello interval do not fix this problem.
Full Explanation
IPsec adds overhead, so a 1500-byte TCP segment that fits on the LAN can exceed the path once encrypted, especially if a device in the middle blocks the fragmentation the router would need. Ping uses small packets and succeeds, but that does not prove large TCP segments fit. Clamping TCP MSS on the tunnel interface makes the TCP endpoints send smaller segments that can pass under the IPsec overhead. The BGP hold timer keeps a routing session alive; with a working ping to the VPC host and healthy security associations, changing that timer will not resolve the stalled transfers. The virtual private gateway does not run OSPF, and an OSPF dead interval does not fragment TCP. An SD-WAN BFD hello interval is not part of this standalone IOS XE IPsec router and does not set MSS. Exam caveat: MSS clamping fixes TCP, but a large UDP transfer can still suffer if Path MTU Discovery is blocked, so the tunnel MTU must also be sane. Practical check: after applying ip tcp adjust-mss on the tunnel, a previously hanging transfer should complete, and a packet capture should show the TCP SYN carrying the lower MSS.