Work out exactly how big a packet fits through a GRE, IPsec, DMVPN, VXLAN, MPLS or PPPoE path, byte by byte, including the ESP padding most calculators guess at. Then get the Cisco interface lines, the MSS clamp, the underlay MTU you need to keep 1500 inside, and the ping that proves it.
Runs in your browser. Nothing you type is uploaded.
Why tunnels break things that look fine
Pings work, the application hangs
Small packets fit. The first full-size packet does not, and if ICMP "fragmentation needed" is blocked anywhere, the sender never finds out. Clamp the MSS and allow that ICMP.
adjust-mss only fixes TCP
UDP, including most VPN and voice traffic, ignores it. Large UDP packets fragment or drop, so set the tunnel MTU properly as well.
OSPF stuck in ExStart
If the two ends of a tunnel have different ip mtu values, the database exchange never finishes. Set the same value at both ends.