Technical Tip: How to adjust the Maximum Transmission Unit (MTU) value

Description

This article describes how to adjust the Maximum Transmission Unit (MTU) value on a FortiGate interface.

Scope

FortiGate.

Solution

The MTU is the largest physical packet size, measured in bytes, that a network can transmit. Any packets larger than the MTU are divided into smaller packets before they are sent. The default MTU is 1500 on a FortiGate interface.

Standard Values for Common Scenarios:

• 1500: Standard Ethernet (Default).
• 1492: PPPoE connections (DSL).
• 1400-1450: Common for IPsec VPN tunnels (to compensate for encryption overhead).
• 9000: Jumbo Frames (Data Centers / SAN / Backups), requires switch support.

SSL VPN v7.6.1+:

Before FortiOS version 7.6.1, the MTU on the virtual SSL VPN interface could not be modified. This functionality has now been added and works like any other interface:

config system interface

    edit "ssl.root"

        set vdom "root"
        set type tunnel
        set alias "SSL VPN interface"
        set snmp-index 3
        set mtu-override enable
        set mtu 1300

    next

end

• Adjust MTU/MSS in an IPsec VPN:

This configuration will help to improve traffic running through an IPsec VPN:

config system interface
    edit <IPSEC_interface_name>
        set mtu-override enable
        set mtu 1400 # Start low, increase gradually

        set tcp-mss 1360
    next
end

• Add MSS clamping in firewall policy:

config firewall policy
    edit <vpn_policy_number>
        set tcp-mss-sender 1360
        set tcp-mss-receiver 1360
        set auto-asic-offload disable
    next
end

Related documents:

Technical Tip: Finding the MTU of the FortiGate interface
Checking that traffic is offloaded by NP processors