Configuration Guide: Avoiding IP Fragmentation in GRE Tunnel Deployments

[Andy_G]

Description

The purpose of the attached document is to explain how to avoid IP Fragmentation with the FortiGate TCP Maximum Segment Size feature when deploying FortiGate firewalls in GRE Tunnel mode.

Scope

Support for GRE tunneling was added in FortiOS 3.0

Support for configuring TCP MSS in firewall policies was added in FortiOS 3.0 MR4

Solution

Contents

* Introduction

* Network Components

* IP Fragmentation and Reassembly Overview

* TCP Maximum Segment Size (MSS) Overview

* GRE (Generic Route Encapsulation) Overview

* Network Architecture

* FGT-1000C Configuration

* FGT-3600C Configuration

* Fortinet TCP-MSS-Sender Option

* Updated Firewall Policies on the 1000C and 3600C

* Fortigate 1000C Firewall Policy

* Fortigate 3600C Firewall Policy

* BreakingPoint Testing (Clients connecting to servers and downloading 32K files)

* First Test

* Second Test