How to clear DF bit on ASA

[Ricky Sandhu]

Good day, we are having an issue where remote-vpn users connecting via the ASA are unable to access a resource. (Rough diagram attached). 

Whenever PC1 is accessing a given resource on the Internet, it has no issues.
However whenever PC2 is accessing the same resource via ASA and FTD, it can't. On FTD the below error gets logged:
Initiator IP: 10.1.1.2     4 (Fragmentation Needed and Don't Fragment was set) / icmp

Why is the ASA setting the DF bit and how can I remove it?

[liviu.gheorghe]

Hello @Ricky Sandhu ,

you can clear the DF bit on ASA by using PBR. For this you will need to configure a route-map:

route-map cleardf permit 10

 set ip df 0

This route-map should be applied on the interface towards PC2:

policy-route route-map cleardf

What the route-map does is match all traffic coming in that interface because there is no match statement, and to that traffic it sets the DF bit to 0 so it can be fragmented along the way.

Edit: PBR is supported on ASA starting with software version 9.4(1).

HTH

[Ricky Sandhu]

Thank you @liviu.gheorghe 

I was able to "go around" the issue by routing traffic from the ASA via an IOS router to the destination on the Internet for now.  But I will keep this in my back pocket for future