A company's users on an IPsec VPN between FortiGate A and B have experienced intermittent issues since implementing VXLAN. The administrator suspects that packets exceeding the 1500- byte default…

Question

Options

• AAdjust the MTU on interfaces only if FortiGate has the FortiGuard enterprise bundle, which
• BAdjust the MTU on interfaces in all FortiGate devices that support the latest family of Fortinet
• CAdjust the MTU on interfaces in controlled environments where all devices along the path
• DAdjust the MTU on interfaces only in wired connections like PPPoE, optic fiber, and ethernet

• A
  4% (1)
• B
  17% (4)
• C
  71% (17)
• D
  8% (2)

Explanation

When using IPsec VPNs and VXLAN, additional headers are added to packets, which can exceed the default 1500-byte MTU. This can lead to fragmentation issues, dropped packets, or degraded performance. To resolve this, the MTU (Maximum Transmission Unit) should be adjusted only if all devices in the network path support it. Otherwise, some devices may still drop or fragment packets, leading to continued issues. Why adjusting MTU helps: VXLAN adds a 50-byte overhead to packets. IPsec adds additional encapsulation (ESP, GRE, etc.), increasing the packet size. If packets exceed the MTU, they may be fragmented or dropped, causing intermittent connectivity issues. Lowering the MTU on interfaces ensures packets stay within the supported size limit across all network devices.

No community discussion yet for this question.