We strongly recommend to use l2tp instead gre because of the MTU issues.
On GRE fragmentation does not exist, fragmentation occurs at IP level (it send ICMP-need-to-frag on packets larger than MTU and packet itself gets dropped).
TCP MSS adjustment (is applied before tunnel) means that you can mangle MSS of TCP SYN packets leaving your network in order that incoming packets do not exceed your maximum MTU (of the tunnel). Adjusting MSS works only for TCP.
L2TP does not need MSS clamp and works for any packet that it need to transport (TCP,UDP, etc.) by fragmenting packets inside the tunnel.
By fragmenting packets inside the tunnel, no ICMP-need-to-frag nor TCP MSS mangling is required.
I think we can use 2 IP addresses, our provisioning team will come back with an answer.
On GRE fragmentation does not exist, fragmentation occurs at IP level (it send ICMP-need-to-frag on packets larger than MTU and packet itself gets dropped).
TCP MSS adjustment (is applied before tunnel) means that you can mangle MSS of TCP SYN packets leaving your network in order that incoming packets do not exceed your maximum MTU (of the tunnel). Adjusting MSS works only for TCP.
L2TP does not need MSS clamp and works for any packet that it need to transport (TCP,UDP, etc.) by fragmenting packets inside the tunnel.
By fragmenting packets inside the tunnel, no ICMP-need-to-frag nor TCP MSS mangling is required.
I think we can use 2 IP addresses, our provisioning team will come back with an answer.
(c) ответ саппорта Voxility.com
Полностью подтверждаю такое положение вещей, L2TP намного более удобен и безгеморроен, чем GRE.
А как вам качество фильтрации voxility?
ReplyDeleteЕсли говорить о фильтрации UDP флудов амплификацией и атак на исчерпание канала - она отличная. Если говорить о фильтрации tcp syn флудов и защиты от application флудов (http и тем более https) - она полнейшее .... ну плохая в общем - постоянно прошибало.
Delete