If you do a lot of work with ipsec vpn's, Cisco documentation recommends a mtu of 1300 on all systems. In my testing about 1330 is typically safe.