IPSEC fragmentation

[fran19422]

Hello, I understand that even if a a Telco Internet circuit supports a standard MTU of 1500 and fragmentation is either not supported or reliable, that this is irrelevant to the fragmentation that may take place on traffic passing via a Fortigate IPSEC tunnel across that Internet circuit i.e. the two concepts are separate.

So, you could have a telco Internet circuit with 1500 MTU and no fragmentation support, but fragmentation can still work WITHIN the Fortigate established IPSEC tunnel.

Am I correct in this thinking ?

Thank you kindly.

[Dhruvin_patel · Accepted solution]

Greetings!

Yes, the MTU and fragmentation settings on a Telco internet circuit are separate from the fragmentation that may occur within a FortiGate IPSec tunnel. Even if the Telco internet circuit has an MTU of 1500 with no fragmentation support, fragmentation can still occur within the FortiGate IPSec tunnel. The FortiGate can handle fragmentation independently within the tunnel to ensure proper transmission of packets across the network, regardless of the MTU settings of the external internet circuit.

Regards!

[Toshi_Esumi]

Get in CLI to check the calculated MTU on the IPsec virtual interface like below:
FortiGate-70F # diag netlink interface list | grep -f atl-vpn
if=atl-vpn family=00 type=768 index=27 mtu=1420 link=0 master=0 <---

Then if the packet size is larger than this size, the FGT would frangment it unless DF bit is set on the packet.

Toshi