Question

A network engineer configures a GRE over IPsec tunnel between an on-premises Cisco IOS XE router and an AWS-hosted Cisco IOS XE router across the public internet. BGP peers establish over the tunnel and small ping tests succeed, but users report that large file transfers and HTTPS sessions to cloud applications stall or fail intermittently. The physical WAN interface uses the standard 1500-byte MTU. What is the most effective configuration change on the tunnel interface to resolve this issue?

Accepted Answer

Set 'ip mtu 1400' and 'ip tcp adjust-mss 1360' on the tunnel interface to account for GRE and IPsec overhead

Answer

Increase the tunnel interface bandwidth statement to match the WAN link speed

Answer

Disable BGP path MTU discovery and lower the BGP keepalive timers on both peers

Answer

Change the IPsec mode from tunnel mode to transport mode to reduce packet size