Enter the IP MTU of the connection carrying the tunnel and the bytes reserved for encapsulation. Inner IP packet limit is the space left for the whole inner packet, including its IP header. Ping data size excludes the inner IP header and the 8-byte ICMP header.
Example: A 1500-byte IP MTU with a chosen 60-byte reserve leaves a 1440-byte inner IP packet and 1412 bytes of IPv4 ping data. The 60-byte reserve is an example, not a general IPsec setting.
For a fixed tunnel reserve, include the largest overhead your selected encapsulation can use, including variable padding. A single packet’s ESP overhead is not necessarily that maximum. This tool calculates a budget; it does not measure path MTU.
An IPv6 link must carry a 1280-byte IP packet. A smaller tunnel budget requires fragmentation and reassembly below IPv6; IPv6 routers do not fragment forwarded packets.