Changing MTU on SPLAT for a Cisco - Checkpoint VPN

[Shahn]

Hi guys

We recently setup an IPSEC VPN between 2 offices using Secureplatform NGX R62 and a Cisco 2600.

Now the tunnel is up and functioning but anything that requires a MTU above 500 will not go through the tunnel at all.

So for example we can ping and ip of 192.168.110.2 fine.
If we set it to ping 192.168.110.2 with a buffer size of 500, it works fine
If we then set it to anything over 500 in buffer size, it won’t make it at all.

We get the same results if we ping back from our other office to us as well.

Now we have checked out the Cisco and that is all setup correctly and there is no MTU setting set on there so that leaves the checkpoint to check and this is where I am running into trouble.

We are using the standalone SPLAT system (not running on windows) so we can’t change the MTU using that MTU changer program so was wondering how I can go about changing the MTU or if anyone else has any ideas of what could be causing the problem.

Regards

Shahn

[cciesec2006]

I think the default setting for ICMP packet size in NGx R62 is set
to 512 bytes. Go into SmartDefense tab and look for ICMP,
you can change the value there to whatever you like, like 2000
and then you can send icmp packets > 500 through the tunnel.

HTH.