topic Re: Fragmentation in Network Security

Fragmentation

bob.bartlett — Fri, 21 Feb 2020 11:00:23 GMT

I have 2 sites that are connected through IPSEC VPN between 2 PIX 525 firewalls and i have replication between 2 NETAPP storage devices that is not performing and it appears that the MTU and fragmentation is affecting it. When i do a ping with size 1500 from one side to the other it fails and as I lower at 1200 it succeeds. I told the firewall to fragment before encryption and set the inside and outside interfaces to 1200 MTU and still no luck. Any ideas

Re: Fragmentation

singhsaju — Fri, 12 Sep 2008 18:01:53 GMT

Change the TCP MSS on PIXs

sysopt connection tcp-mss MSS_size_in_bytes

example : sysopt connection tcp-mss 1200

Re: Fragmentation

bob.bartlett — Fri, 12 Sep 2008 21:16:48 GMT

that didn't seem to help still can't ping across with a ping set to 1500 MTU

Re: Fragmentation

Farrukh Haroon — Sat, 13 Sep 2008 07:39:59 GMT

Try this on both sides (PIX firewalls):

crypto ipsec df-bit clear-df outside

Where 'outside' is your egress VPN interface.

Regards

Farrukh

Re: Fragmentation

andrew.prince — Sun, 14 Sep 2008 09:07:10 GMT

I agree with Farrukh - a solid solution, I would add one more thing, to fragement "BEFORE" encryption - not after:-

crypto ipsec fragmentation before-encryption outside.

I prefer to fragement a clear packet rather than an encrypted packet - jut my personal preference.

HTH>

Re: Fragmentation

bob.bartlett — Tue, 16 Sep 2008 13:32:03 GMT

Where is the appropriate place to tell the PIX what the MSS size should be?

Re: Fragmentation

andrew.prince — Tue, 16 Sep 2008 13:37:57 GMT

In the pix it's a global setting - you can;t define an interface or direction.

Any tcp - syn or syn ack that the firewall see's it will change the MSS to the configured value.

HTH>