Technical Tip: Considerations when using FortiExtender with FortiGate IPsec VPNs
Description
This article describes specific considerations when passing site-to-site IPsec VPN traffic over a FortiExtender acting as a FortiGate WAN extension.
Scope
FortiGate; FortiExtender; IPsec.
Solution
Consideration 1: An IPsec VPN tunnel cannot be established when the FortiExtender obtains a private (non-routable) IP address.
The FortiExtender incorporates a USB modem with a SIM card, which is configured with an access point name (APN) specified by the wireless carrier network that determines the type of IP address obtained by the modem (e.g., dynamic or static, private or public).
The FortiExtender incorporates a USB modem with a SIM card, which is configured with an access point name (APN) specified by the wireless carrier network that determines the type of IP address obtained by the modem (e.g., dynamic or static, private or public).
In some cases, the default APN associated with the wireless carrier (which may be set by default on the SIM card or the USB modem) can result in the FortiExtender receiving a private (non-routable) WAN IP address. In this case, the FortiGate may be able to send outgoing IPsec traffic to the remote VPN peer via the FortiExtender, but the replies from the remote peer may fail to reach back to the FortiGate. This inability to receive replies from the remote VPN peer results in the IPsec VPN tunnel failing to be established on the FortiGate.
The solution is to have the wireless carrier provide a different APN that will result in a public (routable) WAN IP address being provided to the USB modem. This APN can then be configured on the FortiExtender to override the default APN settings.
Consideration 2: Default MTU setting results in stalled or intermittent connectivity over the IPsec VPN tunnel.
Consideration 2: Default MTU setting results in stalled or intermittent connectivity over the IPsec VPN tunnel.
In some cases, the maximum transmission unit (MTU) sizing across the cellular FortiExtender link may be lower than expected, and this can cause IPsec VPN connectivity to intermittently stall (particularly when large packets are being sent over the tunnel).
The solution is to lower the MTU of the FortiGate's FortiExtender WAN interface (e.g., 'fext-wan1'), as well as potentially applying TCP maximum segment size (MSS) clamping. These options help to ensure that packets are not sent out from the FortiGate if they would exceed the path MTU along the FortiExtender cellular link.
To determine the effective path MTU that is supported across the FortiExtender cellular link, use ICMP pings with the 'don't fragment' (DF) bit enabled and with large ICMP data sizes (e.g., 1472 bytes to start with). The largest successful ping will help to determine what the effective path MTU is across the cellular link.
For example, when testing from a Windows workstation, use the CLI command 'ping <destination> -f -l <datasize>', where '<destination>' is the public IP of the ping target and '<datasize>' is the ICMP payload size (1472 byte payload + 20 byte IP header + 8 byte ICMP header = 1500 byte MTU).
For more information, refer to the following KB articles:
- Technical Tip: How to use Ping Command to detect lesser MTU device in the Network Path
- Technical Tip: How to use ping with data-size
Once an optimal MTU value has been determined, adjust the MTU for the FortiExtender interface as follows:
config system interface
edit fext-wan1
set mtu-override enable
set mtu <integer>
next
end
Related articles:
Technical Tip: Setting TCP MSS value
Technical Tip: How to adjust the Maximum Transmission Unit (MTU) value on a FortiGate interface
