Refer to the exhibits. The configuration of a user's Windows PC, which has a default MTU of 1500 bytes, along with FortiGate interfaces set to an MTU of 1000 bytes, and the results of PC1 pinging…

Question

Exhibits

Options

• AOption ip.flags.mf must be set to enable on FortiGate. The user has to adjust the ping MTU to
• BFragmented packets must be encrypted. To connect any application successfully, the user
• CFortiGate honors the do not fragment bit and the packets are dropped. The user has to adjust
• DThe user must trigger different traffic because path MTU discovery techniques do not

• A
  9% (4)
• B
  13% (6)
• C
  77% (36)
• D
  2% (1)

Explanation

The issue occurs because FortiGate enforces the "do not fragment" (DF) bit in the packet, and the packet size exceeds the MTU of the network path. When the Windows PC1 (with an MTU of 1500 bytes) attempts to send a 1400-byte packet, the FortiGate interface (with an MTU of 1000 bytes) needs to fragment it. However, since the DF bit is set, FortiGate drops the packet instead of fragmenting it. To resolve this, the user should adjust the ping packet size to fit within the path MTU. In this case, reducing the packet size to 972 bytes (1000 bytes MTU minus 28 bytes for the IP and ICMP headers) should allow successful transmission.

No community discussion yet for this question.