Question ID : 190
Created on 2012-03-31 at 11:15 PM
Author : Guru Corner [firstname.lastname@example.org]
Online URL : http://kb.guru-corner.com/question.php?ID=190
For example: Throughput for PPPoE can often be improved by reducing MTU to 1452 and enabling fragmentation.
1. Determining the MTU Value for Your Internet Connection
Contact your ISP for the recommended MTU size for your Internet connection (cable, DSL, T1, etc...) or you can also use the
PING command at the Operating System prompt to determine the MTU size.
Ping -f -l #
Example: Ping -f -l 1500 www.yahoo.com
Note: Reduce packet size by 8 byte (1500-8 = 1492, 1484, 1404, etc.) until you get 0% packet LOSS.
Example: Ping -f -l 1492 www.yahoo.com
Explanation of parameters: The switch - f (minus sign followed by lowercase F) indicates do not fragment. The second switch -l (minus sign followed by lowercase L) is for size, and the number following it indicates the packet size you will be sending.
If the PING passes successfully, you will get a reply from the IP address specified. If the packet was too large you will get the message: " Packet needs to be fragmented but DF set" (with 100% packet LOSS). Reduce the packet size until you are successfully connected. Then, use this size when specifying an MTU value.
2. Changing the MTU settings on the SonicWALL appliance
The MTU settings may be found on the following pages of the user interface of SonicWALL appliances:
• Interface MTU - Specifies the largest packet size that the interface can forward without fragmenting the packet.
• Fragment non-VPN outbound packets larger than this Interface’s MTU - Specifies all non-VPN outbound packets larger than this Interface’s MTU be fragmented. Specifying the fragmenting of VPN outbound packets is set in the VPN > Advanced page.
• Ignore Don’t Fragment (DF) Bit - Overrides DF bits in packets.
• Do not send ICMP Fragmentation Needed for outbound packets over the Interface MTU - blocks notification that this interface can receive fragmented packets.
Note: It is recommended to check the 'Fragment non-VPN outbound packets larger than this Interface’s MTU' box if the MTU is set below the default of 1500. Press the OK or Update button to process the changes entered.
3. Allowing Fragmentation on the SonicWALL appliance
An additional setting allowing fragmentation should be made to the default outbound rule. Go to the Firewall > Access Rules (SonicOS Standard and Enhanced) or the Access > Rules page (Firmware 6.x) of the management interface. Find the default rule that allows default from LAN to *. Click the edit icon next to that rule, and check the 'Allow fragmented packets' option. Click OK to update the chagnes.
Making these settings changes will allow fragmented packets to pass from the LAN, and will also allow the SonicWALL to decrease the MTU size of the packet. This can make a big difference on outbound packets that are having trouble getting through.
.............. and so on!
Back to Original Question