Unable to Browse Internet when Using a GRE Tunnel?
Internet Control Message Protocol (ICMP) type 3 code 4 packet
(Destination Unreachable; Fragmentation Needed and DF set).
!
This ICMP message contains the correct MTU to be used by the Web Server,
which should receive this message and adjust the packet size accordingly.
You can view the ICMP messages sent by R2 by enabling the debug ip icmp command:
Blocked ICMP Messages
A common problem occurs when ICMP messages are blocked along the path to the Web server.
When this happens, the ICMP packet never reaches the Web server, thereby preventing data from
passing between client and server.
Further Solutions
Use policy routing to clear and set the DF bit in the data IP packet
route-map clear-df permit 10
match ip address 101
set ip df 0
!
interface ethernet 0
ip policy route-map clear-df
!
access-list 101 permit tcp 10.1.3.0 0.0.0.255 any
This will allow the data IP packet to be fragmented before it is GRE encapsulated.
!
The receiving end host must then reassemble the data IP packets.
The end hosts now send TCP/IP packets no larger than this value.
interface tunnel0
ip tcp adjust-mss 1436
The router on the other end of the GRE tunnel must reassemble the GRE tunnel packet
before it can remove the GRE header and forward the inner packet.
IP packet reassembly is done in process-switch mode and uses memory.
Therefore, this option can significantly reduce the packet throughput through the GRE tunnel.
interface tunnel0
ip mtu 1500
