05-15-2023 03:49 AM
If the checkbox for Fragmented traffic is uncheck, does that mean that the fw will not discard fragmented traffic?
I have a case where someone says "10.154.74.0/23: We can not send from, or send to, packages bigger than 1472. All ports are defined to 9216 bits. 10.154.74.17 and 10.154.74.34 can be pinged with big packages."
I checked the interface and it has an MTU size off 1500
With the setup shown, will it mean that the fw allows fragmentation, and will it do so in both directions?
If it only allows it in one direction, is it possible to allow it in both direction? and if so, how do I do that?
05-17-2023 01:21 PM
Thank you for your answer. I checked the jumboframe and it was already enabled.
I got some more info.
There are two situations. One where it works and one where it don`t work:
The source is the same but the destionation address is different and is in two differente DC. There exists opening for both secenarios.
The src and dst address is in the same DC and the traffic only need to go through one zone and one fw. In this case, everything works as intended.
The src and dst address is in two different DC`s and the traffic goes through three zones. In this case the fragmentet traffic is not received at the dst.
From what I can see from the traffic log, the traffic is allowed in both situations, but is there someway to see if fragmented traffic is going through in some way or is it enough to see that the traffic is allowed in the traffic log?
They also did some ping where should have issued a ping with up to 1472 packets (if you can say it like that) and it went through, but if they issued a ping from 1473 and above it didn`t work. Does this give any sense?
Is there something else I should check?
I am not sure if this is a fw issue or not.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!