packets dropped because of failure in tcp reassembly

[KiCheon.Lee]

Hello all,

Here is network diagram as below

Juniper FW(Branch)

    |

Internet

    |

PalAlto (HA A-P)

    |

BackBone - Juniper FW

My customer use IPSec VPN between both Juniper FWs.

PaloAlto active device changed from #1 device to #2 device at last week(Link Fail-Over)

Then they doesn't connect IPSec VPN.

I have checked 'global count' between 2 hosts.

It increase 'packets dropped because of failure in tcp reassembly' counts.

Why does it increase?

And how way does it resolve??

Thanks.

[UhMayYeah]

This a warn counter which indicates that reassembly has failed for some tcp transmissions. It increments generally  due to asymmetry  or external causes.

If this counter becomes excessive it could be indicative of an external network issues.What are the other warn/drop counters that you see incrementing?

Try

# set deviceconfig setting tcp asymmetric-path bypass

#commit