topic Panorama fragmentation in Next-Generation Firewall Discussions

Panorama fragmentation

Richard_M — Mon, 15 May 2023 10:49:54 GMT

Hi,
If the checkbox for Fragmented traffic is uncheck, does that mean that the fw will not discard fragmented traffic?

I have a case where someone says "10.154.74.0/23: We can not send from, or send to, packages bigger than 1472. All ports are defined to 9216 bits. 10.154.74.17 and 10.154.74.34 can be pinged with big packages."

I checked the interface and it has an MTU size off 1500

With the setup shown, will it mean that the fw allows fragmentation, and will it do so in both directions?
If it only allows it in one direction, is it possible to allow it in both direction? and if so, how do I do that?

Re: Panorama fragmentation

kat3xx — Tue, 16 May 2023 10:12:16 GMT

If it's checked then you will drop all fragmented traffic, so you are correct.

Perhaps you need to enable jumboframes if you haven't done so already?

Re: Panorama fragmentation

Richard_M — Wed, 17 May 2023 20:21:30 GMT

Hi @kat3xx
Thank you for your answer. I checked the jumboframe and it was already enabled.

I got some more info.
There are two situations. One where it works and one where it don`t work:
The source is the same but the destionation address is different and is in two differente DC. There exists opening for both secenarios.

Situation 1:
The src and dst address is in the same DC and the traffic only need to go through one zone and one fw. In this case, everything works as intended.

Situation 2:
The src and dst address is in two different DC`s and the traffic goes through three zones. In this case the fragmentet traffic is not received at the dst.

From what I can see from the traffic log, the traffic is allowed in both situations, but is there someway to see if fragmented traffic is going through in some way or is it enough to see that the traffic is allowed in the traffic log?

They also did some ping where should have issued a ping with up to 1472 packets (if you can say it like that) and it went through, but if they issued a ping from 1473 and above it didn`t work. Does this give any sense?

Is there something else I should check?
I am not sure if this is a fw issue or not.