After reading the reposting of my article on path MTU discovery in NIL's CT3 wiki, Steve Milsom wrote in to share an interesting observation. Disabling ICMP unreachable messages on a router with no ip unreachables (as is recommended by many BCP documents) has a side effect of breaking path MTU discovery. Let's take a look at what happens.

Recall that path MTU discovery is accomplished by setting the Don't Fragment (DF) bit in an outgoing IP packet, and receiving an ICMP unreachable message in the event that the packet sent exceeded the MTU at some point in the path. We can create an artificially small outgoing IP MTU on an interface with the ip mtu command in IOS to see path MTU discovery in action. We'll set the IP MTU of R2's F0/0 interface to 1200 bytes.

R2(config)# interface f0/0
R2(config-if)# ip mtu 1200

Now, by setting the DF bit in oversized ping from R1 to R3 we can see that we receive ICMP unreachable messages from R2, indicating that packet fragmentation is required to meet R2's outbound MTU.

R1# ping ip 10.0.0.6 df-bit size 1400

Type escape sequence to abort.
Sending 5, 1400-byte ICMP Echos to 10.0.0.6, timeout is 2 seconds:
Packet sent with the DF bit set
M.M.M
Success rate is 0 percent (0/5)

The letter M (for MTU, I suppose) in the output signifies the reception of an ICMP unreachable packet with code 4 (fragmentation needed). (The alternating dots indicating missed responses are due to IOS' default ICMP rate-limiting.)

Now we'll disable the transmission of ICMP unreachables out of R2's F0/1 interface with the no ip unreachables command:

R2(config)# interface f0/1
R2(config-if)# no ip unreachables

Observe what happens when we try the oversized ping from R1 again:

R1# ping ip 10.0.0.6 df-bit size 1400

Type escape sequence to abort.
Sending 5, 1400-byte ICMP Echos to 10.0.0.6, timeout is 2 seconds:
Packet sent with the DF bit set
.....
Success rate is 0 percent (0/5)

Instead of responding with helpful ICMP messages, R2 simply drops our oversized packets. Think carefully about where you disable ICMP unreachables, as our experiment shows that path MTU discovery simply doesn't work without them.