Description
This article describes how to override the MTU of an IPSec VPN Interface from CLI.
By default, the MTU of an IPsec VPN Interface is dynamically calculated. Before v6.4.0, the user will not be able to manually override. From v6.4.0, the user can override the MTU of an IPSec VPN Interface.
Scope
FortiGate.
Solution
From CLI:
config system interface
edit ipsec-tunnel-1 <------ Replaces withthe tunnel interface name.
set mtu-override enable/disable
set mtu 1400 <------- Set the desired MTU settings.
end
end
To check if the MTU size has changed, use one of the following commands:
fnsysctl ifconfig < Phase-1 name> (For eg-> ipsec-tunnel-1 )
diagnose vpn tunnel list
Output:
ipsec-tunnel-1 Link encap:Unknown
UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1400 Metric:1
RX packets:405 errors:0 dropped:0 overruns:0 frame:0
TX packets:373 errors:58373915 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:0
RX bytes:25196 (24.6 KB) TX bytes:22380 (21.9 KB)
