Fragmenting IP packets before IPsec encapsulation
The ip-fragmentation command controls packet fragmentation before IPsec encapsulation, which can benefit packet loss in some environments.
For example, when a packet is encapsulated and exceeds the MTU size but it is NP-offloaded, the NPU cannot generate an ICMP unreachable, need to frag message. This message can only be generated when NPU offloading is disabled. This can lead to packet loss because the sender cannot be notified and the IP fragments cannot be transmitted.
By enabling pre-encapsulation, the TCP packet is fragmented before it is encapsulated, so all fragments are encapsulated and transmitted as ESP packets.
The following options are available for the ip-fragmentation variable.
|
Option |
Description |
|---|---|
|
|
Fragment before IPsec encapsulation. |
|
|
Fragment after IPsec encapsulation (RFC compliant) (default value). |
To configure packet fragmentation using the CLI:
config vpn ipsec phase1-interface
edit "demo"
set interface "port1"
set authmethod signature
set peertype any
set net-device enable
set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1
set ip-fragmentation pre-encapsulation
set remote-gw 172.16.200.4
set certificate "Fortinet_Factory"
next
end
In 7.6.1 and later, FortiGate does not reduce the MSS size. It only uses the ICMP_FRAG_NEEDED message to notify the sender of the MTU size so that the sender can adjust the TCP MSS and packet size. In earlier versions, when TCP traffic goes through an IPsec tunnel, FortiGate would reduce the TCP MSS size if the packet was larger than the tunnel's MTU. FortiGate would then use the ICMP_FRAG_NEEDED message to notify the sender of the MTU size so that the sender can adjust the TCP MSS and packet size.