SSL VPN disconnect due to invalid packet size

Zyxel_Kevin

In offices where SSL VPN is deployed, everything works fine with SSL VPN but some specific computers have the disconnection issue. SSL VPN tunnel may be disconnected immediately or disconnected after a period of use. This article will explain the possible reasons for this issue.

Symptom

When the issue happens,  the message “SSL tunnel receives a packet with invalid packet size” appears in the log.

Capture packets of the SSLVPN network card at the same time. You will find “IP Fragmentation” message.

Cause

The default MTU size for VPN client network card is “1370”. When the transfer size exceeds the MTU, VPN will be disconnected.

Solution

1) Open “Device Manager”, click “TAP-Windows Adapter V9 for Zyxel SecuExtender”. In advanced tab, set the MTU value as “1370”.

 

2) Enter the following command to verify if the MTU size is correctly changed. The MTU size must be 1370.

netsh interface ipv4 show subinterface

3) It may not be applied successfully due to system problem even if you have change in “Device Manager”. Enter the following command to force the change.

netsh interface ipv4 set subinterface “Network Card Name” mtu=1370 store=persistent

Note: You can find network card name in “Control Panel\Network and Internet\Network Connections”