fortigate 60D support jumbo frame?

[john8098]

Any one know fortigate 60D support jumbo frame? i was unable to find it in specification. expert pls help. internet (wan) 100mbps nic => fortigate 60d => 2 xenserver 1gbps nic if this config ok to enable jumbo frame? will this benefit from the jumbo frame?

[emnoc]

If the interface in question is truly connected to the internet, than jumbo frames is not going to help you. The internet does not support jumbo frames end2end.

[ede_pfau]

Hard to tell as this setting is hardware dependent. I' ve tested an MTU of 9000 on a 80C, WAN-Port (GbE), model rev. 1. Worked. High end models which have an NP do support it. But...the CLI Ref. states that 9000 bytes is the maximum, not 9K = 9216 bytes. The lighter side of it: you won' t notice any difference concerning internet traffic (as it is limited to 100 Mbps), of not much of a difference for traffic between your servers if both are connected to separate ports of the FGT.

[john8098]

Since 2 server will be having connection internally via firewall , using jumbo frame will still have some benefit right? I know to config this 2 server to support jumbo frame, so in firewall i still need to enable jumbo frame support in firewall via cli?

[ede_pfau]

Yes, and yes. This is how:

 conf sys int
 edit <port1 name>
 set mtu-over ena
 set mtu 9000
 next
 edit <port2 name>
 set mtu-over ena
 set mtu 9000
 next
 end

Be aware that the server need to be connected to 2 separate ports, not 2 ports on the internal switch. IMHO 9000 bytes is the maximum allowed, not 9 KB.

[emnoc]

Since 2 server will be having connection internally via firewall , using jumbo frame will still have some benefit right?

I want to caution you on the yes/yes , if the servers interfaces don' t support jumbo frames nor if any layer2 segments that these servers cross, then you will not see any benefits from " jumbo frames" per se. What type of devices are these servers ? ( windows/unix/linux,etc....) What protocol are you using ( tcp or udp ) ? have you done any layer4 protocol analysis to look at tcp session and traffic between the server+client(s)? FWIW: wireshark/tshark and tcptrace, are a few open-source tools, that would allow you monitor and trace tcp session

[john8098]

server interface is intel I350 gigabit. there is no anything between server and firewall, server directly connect to different port of firewall. What type of devices are these servers ? xenserver (linux base) What protocol are you using ? firewall have tcp & udp on different port on xenserver and windows or linux virtual machine have you done any layer4 protocol analysis to look at tcp session and traffic between the server+client(s) . i not expert don' t know need to look at tcp session on those traffic. ( just hope enable jumbo frame will increase iops & reduce cpu usage )

[ede_pfau]

@emnoc: Caution is always a good idea. In this case I am assuming that john8098 knows what he is doing - that the NICs, switches and the fortigate need to support jumbo frames. And that otherwise traffic will break down soon. Whether jumbo frames will enable higher troughput or higher I/O rates can best be seen in practice. Again, his call.

[AndreaSoliva]

Hi the question if a device is supporting Jumbo frames is a question of driver: " see picture meaning table" This means first you have to find out the driver (example): # diagnose hardware deviceinfo nic [Name des Ports zB port3] Driver Name :Fortinet Nplite Driver Version :1.0 Admin :up Current_HWaddr 00:09:0f:96:d3:e0 Permanent_HWaddr 00:09:0f:96:d3:e0 Status :up Speed :100 Duplex :Half Host Rx Pkts :17153 Host Rx Bytes :1489283 Host Tx Pkts :79855 Host Tx Bytes :4152490 Rx Pkts :17154 Rx Bytes :1729485 Tx Pkts :79855 Tx Bytes :4791300 rx_buffer_len :2048 Hidden :No cmd_in_list :0 If the driver is supporting Jumbo frames you can adjust within the interface config: # config system interface # edit [name of interface] # set mtu-override enable # set mtu [Jumbo Frames value exampel 9000] # next # end Hope this helps have fun Andrea