Small pings across an IPsec tunnel work. Large pings fail, and the don't-fragment bit is set. The tunnel MTU is higher than the path can carry. TCP is not the traffic that fails. What should be lowered?
Select an answer to reveal the explanation.
Short Explanation
Small notes get through and the big ones are marked do-not-cut. You lower the tunnel MTU so those pings fit the path. The don't-fragment bit is why they die instead of being split, and a routing timer is not the ping size.
Full Explanation
Packets larger than the path, with the don't-fragment bit set, are dropped instead of fragmented. Small pings fit. Large pings do not. The tunnel MTU is higher than the path between the campus and the cloud can carry, so lower the tunnel MTU until the large pings fit. This failure is the large ping, so the tunnel MTU is what has to come down. The BGP hold timer does not set a ping size. The OSPF cost does not drop ICMP above a threshold. A shorter IKE lifetime changes rekey. It does not fragment the pings. Exam caveat: pick the MTU from a test on this path, such as the largest ping that succeeds, rather than from a number copied from a different circuit. Operational check: after the tunnel MTU is lowered, the same large ping should succeed and the small ping should still succeed.