[walterhw]

I'm trying to configure an SPA3000 through a VPN. If I try to access the admin pages directly through the VPN, they always fail to load, but the basic pages always load OK and advanced pages sometimes load OK. However, if I log into a host that is on the same LAN as the SPA (still using VPN), I can configure the SPA using a web browser running on the local host. In that case, only the screen images from the local host are going through the VPN.

I have had no problems configuring an SPA-2100 directly through this VPN for all configuration pages.

1) I suspect the SPA may be sending too large a packet which fails to fragment/reassemble correctly when sent directly through the VPN. Is there a way to set the MTU used by the SPA3000? The current firmware is 2.0.13(GWg).

2) Is it likely that loading firmware 3.1.7 on to the SPA3000 will make any difference or provide MTU setting?

Thanks.

[rizsher]

The SPA3000 has no built in router function, you'll need to set the MTU setting on the router (or modem) you;re connecting it to.

[walterhw]

Yes, you're right, it's more of an application parameter. The MTU of the SPA3000 Ethernet interface is probably the standard 1500 bytes. I'm actually looking for a way to adjust the maximum packet size sent by the SPA-3000 web server application to a smaller value that can pass through the VPN without being excessively fragmented along the way.

What I believe is happening now is that the SPA3000 sends the admin web pages (probably all web pages) as one big packet in excess of 3K bytes. The packet is fragmented first at the LAN interface and then possibly along the way and re-assembled at the endpoint. This works fine on the LAN, but I know that the VPN is not able to re-assemble packets larger than about 3.4K.

Many network applications will go through the process of discovering the path MTU. But, it seems that the SPA3000 does not do this for web pages. So, I am looking for a way to set the maximum packet size manually to test if packet fragmentation and failure to reassembe is the source of the problem.

[Kir]

walterhw,
If your router supports it, you can set an MTU on the ethernet interface of the router your SPA connected to.

[AndrewG]

Originally Posted by walterhw

I'm trying to configure an SPA3000 through a VPN. If I try to access the admin pages directly through the VPN, they always fail to load, but the basic pages always load OK and advanced pages sometimes load OK. However, if I log into a host that is on the same LAN as the SPA (still using VPN), I can configure the SPA using a web browser running on the local host. In that case, only the screen images from the local host are going through the VPN.

Check the reply I just posted in another thread, http://voxilla.com/index.php?name=PN...&p=35812#35812.
The symptoms match yours, but the cause wasn't an MTU problem (although yours may well be -- it also fits your symptoms). What browser are you using and what OS is it running on?

--
Andrew Gabriel

[walterhw]

Sorry, I'm not being clear.

I don't think the packet size of the fragments is the source of the problem. Changing the MTU in the router will only affect the size of fragments because the packet is already fragmentented by the time it leaves the LAN interface of the SPA3000. After that, the router can only fragment it further.

The problem, I think, is that the web server application in the SPA3000 attempts to send web pages as one big packet. The LAN interface on the SPA-3000 then fragments that packet and routers along the way may fragment it further. When all works well, the receiving interface reassembles the original big packet. In my case, the VPN is not able to reassemble such a big packet. (Note that I have not captured any packets on the LAN to confirm this guess)

So, what I want is for the web server application in the SPA to send web pages as a series of smaller packets, small enough to get through the SPA3000 LAN interface without being fragmented and, hopefully, small enough to escape any fragmentation along the path so no reassembly will be required at the receiving interface.

I must admit I am doubtful that a setting is present to affect this packet size. It would, of course, be possible to make a change to the web server on the SPA3000 so that it sends in small packets. But, only Sipura can do that. And configuring SPA-3000 using web pages through anything other than the local LAN is probably not widely used. Configuring from a host located on the LAN does work fine for me. It's only configuring directly through a VPN where no local host is present that gives me a problem with the SPA-3000, but it's not a problem with the SPA-2100.

[Kir]

walterhw,
This is not how TCP/IP works...

[walterhw]

AndrewG

Yes, the symptoms you describe are exactly like what I'm experiencing. Your description of the problem would also explain why sometimes the advanced pages load and sometimes they don't. What I see is that the page partly loads and then the browser sits busy doing nothing until the connection is reset (and the partly loaded page disappears, but that's probably a browser property).

I experience the problem using:

Firefox 1.5.01 or IE 6.0.2900....
Windows XP
SafeNet SoftRemote 10.1.1 (Build 10) VPN client rebranded by Netgear as Netgear ProSave VPN Client

I would think that the VPN client could well advertise a different TCP window size to the other VPN endpoint than the underlying TCP/IP stack does. I'll have a look for anything like a TCP window size in the VPN settings, thanks for your pointer.