ALLOW fragmented packets?

[beaven67]

I was looking at the FortOS admin guide for 5.0 and it looks like the firewall will pass fragmented tcp packets but not udp packets. Does anyone know if there is a way to get the firewall to pass any fragmented packet the arrives on an internal interface of the firewall. We have been troubleshooting some performance issues with a management tool and found that it needs to allow fragmented packets and upnp support. Any idea' s?

[emnoc]

Will it' s more than just passing fragments. You should not fragments and with udp or even tcp , & it is frown upon ( DDoS inspection gear, IPS, etc.....)? Layer4 information is not carried over in the frags. Ideally you want to fragment at the source and not rely on fragmentation at L3 devices. have you looked at to ignore the df-bit in the l3 header of ip_packet config sys global set honor-df enable ! the default btw end

[rboe]

have you looked at to ignore the df-bit in the l3 header of ip_packet

shouldn' t he set this to ' disable' instead of ' enable' in action to ignore the df bits of the ip_packet? set honor-df disable -> set FGT to ignore DF bits of any ip_packet -> test it -> if ok: check source why they set df bit in ip_packets. regards

[emnoc]

set honor-df disable

No you have it backward. You set the value to " disable" to not honor the df bits. If the df bits are toggle high ( 1 ) than any layer3 device will drop the packet if the packet is larger than the effective mtu. http://docs-legacy.fortinet.com/fos50hlp/52/index.html#page/FortiOS%25205.2%2520Help/system.004.34.html Other options ( cisco/juniper ) you can craft a policy to clear the DF-bit on all traffic before reaching the L3 device. i.e by using a route-map route-map cleardf permit 10 set ip df 0 and then apply it; ip policy route-map cleardf Other options for tcp is to set the tcp-mss, you can do this global for most routers and on a fortigate with firewall policys that are for tcp-traffic you can set it in the fwpolicies.