MTU IPSEC site to site

Hi Samps,

Thank you for reaching out to the Community! 

Check out the route-based IPsec site-to-site VPN, it's possible to set the MTU per xfrm interface.

• Create a route-based VPN

Reference screenshot:

Thanks,

Hi Patel,

I'm on version V17.5MR15. sorry I should have specified it ...

Hi Samps,

The long-term solution would be to update the firmware to SFOS v18 and configure route-based IPsec site-to-site VPN according to the following KBA. 

• Sophos XG Firewall: How to set the MSS value for the remote network(s)

If the firmware update isn't possible, there might be an option only to set MUT for specific remote and local networks, requiring some backend route/configuration changes. I'd suggest you open a support case for further investigation.

Thanks,

Hi Patel,

My hardware not allows me to update to V18 for both side so I will open a ticket with the support.

Thank you for your help.

Hi Samps,

Thank you for the update. Would you mind providing the support case via personal message? I'll add an internal note to change the MSS for the traffic to the remote networks. 

Thanks,