Unable to modify the MTU and MSS for auto-generated interfaces created via IPSec profile for a router.

MTU and MSS parameters are grayed out under Configuration --> Authority --> Router --> Node --> <Remote device interface> (autogenerated) --> <Remote device interface>-intf --> MTU or Configuration --> Authority --> Router --> Node --> <Client device interface> (autogenerated)--> <Client device interface>-intf --> MTU

The 128T-ipsec-client plugin provides a way to send and encrypt traffic to IPsec endpoints through the SSR. It is possible to configure the plugin for each router to have multiple destination IPsec endpoints and thus the SSR will failover between them. This is accomplished by performing a Service Function Chain (SFC) with Libreswan, a third-party IPsec client. By enabling this plugin, you can provide IPsec tunnel connectivity to third party providers from your SSR.

The IPsec plugin setup has the following key parts to the configuration.

• ipsec-profile describing the mechanism with which to connect to the server.
• ipsec-client represent the remote endpoints or server with which the ipsec client communicates.
• service-route's to route the traffic through the tunnels

A KNI per remote is created with the name of the remote and a single egress KNI is created with the name of the ipsec-client.

Upon the commit of the above configuration, SSR creates two auto-generated device interfaces and network interfaces as below.

Device interface example:

The respective network interfaces for each of the device interfaces present in the above image are named as below.

spoke-vpn : spoke-vpn-intf

remote : remote-intf

The MTU parameters for each of the above interfaces are grayed out as seen in the below images.

SPOKE-VPN MTU / Enforced mss Parameters:

REMOTE-INTF MTU / Enforced MSS Parameters:

As we can see in the above images, the MTU as well as the enforced MSS options are grayed out. The reason for the same is that these network interfaces are used for the handling of the internal traffic between the spoke-vpn and remote device interfaces. The MTU for both these interfaces is auto-generated on the basis of the MTU parameter defined in the IPSEC profile created in SSR.

You can configure the MTU and the enforced MSS (custom) on the remote IPSec tunnel interface. The configuration is available at Authority --> router --> node --> ipsec-client --> remote --> MTU / Enforced MSS.