Prisma® Agent tunnels cross ISP networks, including carrier-grade NAT (CGNAT) networks, where the maximum transmission unit (MTU) of the path, known as the path MTU (PMTU), is often lower than 1500 bytes. These networks commonly block or rate-limit Internet Control Message Protocol (ICMP) messages, so standard operating system PMTU discovery can fail to learn the correct value. If the tunnel MTU is higher than the path supports, some network hops drop packets and users can't reach websites. When Optimized MTU is enabled, which is the default, the agent selects the tunnel MTU for you, so you don't need to determine and configure the value manually. If you disable Optimized MTU, the agent uses the MTU that you configure.

The agent measures the path to the gateway by using up to three methods and uses the smallest value that it finds, because a value that is too high is more likely to cause dropped packets than one that is too low. Maximum segment size (MSS) checks read the MSS of a TCP connection to the gateway. ICMP-based probing sends probes of different sizes to find the largest size that passes without fragmentation. On Windows only, the agent also checks the operating system PMTU cache before the tunnel connects.

If no measurement is available when the tunnel connects, the agent starts with the static MTU so the tunnel connects without delay, and then refines the value as MSS and ICMP measurements arrive. After the agent applies a measured value, the MTU can only decrease for the life of the tunnel. A lower MTU has a minimal effect on performance, but a higher MTU can leave users unable to reach websites, and a decrease-only rule prevents changing network conditions from making the MTU fluctuate. The MTU resets when users connect to a different gateway.

The discovered PMTU is a best estimate, not a guaranteed value, because PMTU depends on the protocol, can differ in each direction, and can change over time. To see the values that the agent would use for a gateway, you can run the pacli pmtu command described in Configure the Prisma Agent MTU.