Technical Tip: Connection issues due to MTU between Collector and Super/workers

[vtsonev]

Description	This article describes how to troubleshoot connection issues between Collector and Super/Worker due to mismatch/wrong MTU.
Scope	FortiSIEM v6.0 and above.
Solution	In some cases, the Collector can experience issues reaching or uploading data to the Super or the workers. This might be related to MTU of the interface. The MTU of an interface is the size of the largest block of data that can be transmitted as a single unit. Anything larger than the MTU size must be fragmented into smaller units prior to transmission. The default MTU value is set to 1500 bytes: To determine the MTU size, some tests can be performed using ping with the 'don’t fragment' flag set. ping -c 1 -s <mtu size> -M do <super/worker ip address> Alternatively, use the tracepath command: tracepath –n <super/worker ip address> For example using ping with MTU set to 1473 +28= 1501. As a result the ping fails: Testing with MTU 1472 bytes and the ping will succeed. Changing the collector’s interface MTU value: Non-Persistent Change: ifconfig <interface> mtu <mtu size> up ifconfig eth0 mtu 1400 up Persistent Change    (eth0 shown). Edit /etc/sysconfig/network-scripts/ifcfg-eth0 Add MTU, settings to the file:               MTU= "1400" Save and close the file. Restart networking:   service network restart