Troubleshooting Tip: How to change the MTU to fix an ESP fragmentation Issue

[Dongfang_Li_FTNT]

Description	This article describes how to fix an ESP fragmentation issue by changing the MTU size.
Scope	FortiGate.
Solution	When traffic is sent to the IPSec tunnel from the local FortiGate and it is not received by the remote FortiGate, it is possible to run a sniffer in the remote FortiGate to check the ESP packet to see if there is an error or drop in the ESP packet. diagnose sniffer packet any 'host 192.168.10.10 and proto 50' 4 Where 192.168.10.10 is the FortiGate that initiates traffic.   If there is ESP fragmentation, for example: The original direction traffic is fragmented, but the reply traffic is fine. The user can reduce the MTU in the IPsec VPN tunnel interface in the source FortiGate 192.168.10.10: config system interface     edit <tunnel interface>         set mtu-override enable         set mtu <integer>     next end To fine-tune the MTU and use the maximum possible value, a tool to verify the maximum MTU can be used, for example, this document: mturoute.exe - Debug the MTU values between you and a host. From the maximum allowed MTU, the IPsec header overhead should be removed.