Allow Fragmentation over IPSEC?

[#1]

We have a need to allow fragmentation and reassembly of packets prior to being IPSEC encapsulated but I can' t find the appropriate command within the FortiOS CLI or GUI that wuold allow this. Essentially some of our VoIP packets between offices are getting dropped because once encapsulated they are larger than the standard 1500 MTU size. We need to be able to flag those IPSEC packets to be fragmented prior to encapsulation if the encapsulated size will end up over 1500. I know that SonicWalls have a feature called ' Enable Fragmented Packet Handling" that does this and with Cisco devices you can issue the command ' crypto ipsec df-bit clear' to clear the ' Do Not Fragment' bit in the packet header that keeps packets from fragmenting...how can I accomplish the same thing with FortiOS?

[emnoc]

Hmm [>:] Typical VoIP packets are nowhere remotely close to the max MTU size of std ethernet. What codec are you running? If you do a tcpdump/wireshark capture of the voice bearing payload, it should be UDP and under 220bytes. At most with overhead you have IP-UDP-RTP or RTPc headers and that would put you around 40bytes or less of overhead, the voice payload is about on avg 160-180bytes tops depending on codec type ( 711 vrs 729A vrs 723.1 vrs 728 etc... ) Basically if your dropping packets, I doubt it has anything to do with the VPN and 1500byte mtu.

[FortiRack_Eric]

I tend to agree with emnoc. But if you want to accomplish this, you can set MTU and tcp-mss via the cli for the virtual (IPsec) interface. Cheers, Eric