Allow Fragmentation over IPSEC?

Question

We have a need to allow fragmentation and reassembly of packets prior to being IPSEC encapsulated but I can' t find the appropriate command within the FortiOS CLI or GUI that wuold allow this.  Essentially some of our VoIP packets between offices are getting dropped because once encapsulated they are larger than the standard 1500 MTU size.  We need to be able to flag those IPSEC packets to be fragmented prior to encapsulation if the encapsulated size will end up over 1500.    I know that SonicWalls have a feature called ' Enable Fragmented Packet Handling"  that does this and with Cisco devices you can issue the command ' crypto ipsec df-bit clear'  to clear the ' Do Not Fragment'  bit in the packet header that keeps packets from fragmenting...how can I accomplish the same thing with FortiOS?

emnoc · Answer

Hmm [>:]    Typical VoIP packets are nowhere remotely close to the max MTU size of  std ethernet.  What codec are you running?      If you do a tcpdump/wireshark capture of the voice bearing payload, it should be UDP and under 220bytes.  At most with overhead you have IP-UDP-RTP or RTPc headers and that would put you around 40bytes or less of  overhead, the voice  payload is about on avg 160-180bytes tops depending on codec   type ( 711 vrs 729A vrs 723.1 vrs 728 etc... )      Basically if your dropping packets, I doubt it has  anything to do with the VPN and 1500byte mtu.

Sign up

Login with SSO

Login to the community

Login with SSO