Technical Tip: Packet fragmentation for chassis based FortiGate

• Default Configuration:

config load-balance setting 

    config workers 

        edit 3 

            next 

        edit 4 

            next 

        end 

    end

The first part of the packet is sent to the correct worker, but all subsequent fragments are broadcast.

• Enable DP fragment session:

config load-balance setting

    set dp-fragment-session enable

        config workers 

            edit 3 

        next 

            edit 4 

        next 

    end 

end

The behavior remains the same: the first part of the packet is sent to the correct worker, but fragments are broadcast.

• ISF sw distribution method change:

config load-balance setting

    set dp-fragment-session enable

        set sw-load-distribution-method src-dst-ip

            config workers 

                edit 3 

            next 

                edit 4 

            next 

        end 

    end

The first part of the packet is sent to the correct worker, and all fragments are also sent to the correct worker.

Note: This is not available for FortiGate models with a 7000F Series chassis.

Related document:

Load balancing TCP and UDP sessions with fragmented packets