If the DTLS tunnel cannot be established or it is dropped at some point, the client fails over to TLS and adjusts the MTU on the virtual adapter (VA) to the TLS MTU value (this requires a session level reconnect). Now, the ASA computes the encapsulation overhead for both TLS/DTLS and derives the MTU values accordingly.Īs long as DTLS is enabled, the client applies the DTLS MTU (in this case 1418) on the VPN adapter (which is enabled before the DTLS tunnel is established and is needed for routes/filters enforcement), to ensure optimum performance. Previously, the client derived a rough estimate MTU which covered both TLS/DTLS and was obviously less than optimal.

This could be because of two reasons:Īs of ASA Release 9.x and An圜onnect Release 3.x, an optimization has been introduced in the form of distinct Maximum Transition Units (MTUs) that are negotiated for TLS/DTLS between the client/ASA. The cause of this issue is the failure to build a Datagram Transport Layer Security (DTLS) tunnel. Private network may need to be restarted. ******************************************ĭescription : The entire VPN connection is being reconfigured.ĭescription : Message type information sent to the user:ĭescription : A new MTU needs to be applied to the VPN network interface.ĭisabling and re-enabling the Virtual Adapter. Transmitting large packet 1418 (threshold 1347).

This syslog is seen on the ASA: %ASA-6-722036: Group User IP

In this example, the An圜onnect client is shown as it reconnects to the ASA. An圜onnect Client Release 3.0 or Release 3.1.This is dependent upon a few other factors which are discussed in this document. The users might not be able to receive traffic over the Transport Layer Security (TLS) tunnel until An圜onnect reconnects. This document discusses the specific scenario where the An圜onnect client might reconnect to the Adaptive Security Appliance (ASA) in exactly one minute.

Improve cisco anyconnect vpn speed