Troubleshooting Tip: VXLAN dropping SSL traffic
| Description | This article describes how to handle an issue with traffic passing through a VXLAN where SSL traffic fails to load. |
| Scope | FortiGate. |
| Solution | VXLAN passes all traffic except SSL traffic.
Troubleshooting steps:
If the SSL traffic is failing without UTM as well, run the following sniffer:
diagnose sniffer packet any ' host a.a.a.a ' 4 0 l <----- a.a.a.a is the destination IP. If the sniffer output shows 'Destination unreachable (Fragmentation needed)', verify the following:
Change policy TCP-MSS as per the software switch MTU:
config firewall policy edit 1 <Policy that applies to the affected traffic> set tcp-mss-sender 1330 set tcp-mss-receiver 1330 end
Related document: |
