Quantcast
Channel: All SRX Services Gateway posts
Viewing all articles
Browse latest Browse all 17645

Re: VPN fragmentation - How to check if SRX send fragments

$
0
0

Hi R_J

 

As you have mentioned that the remote peer complains that the packet received are fragmented , I should assume that the packets are fragnmented post encryption. So if tghis is the case SRX would be fragmenting the data on the egress interface not on st0.

In order to test of SRX is fragmenting it , please issue the command to copy the df bit from ineer ip header to outer ip header and send the ICMP packets across tunnels with df bit on and with various packet size to identify the PMTU.

This will not allow the traffic to reach remote end if it has to be fragmented by SRX and ICMP error message will be sent with correct MTU. ( Apply filter on egress interface to count number of packets sent out)

 

 

Another option is to  apply the flow trace on srx for the ESP packet ( with local and remote peer ip) as filter to see if same ipid is seen more than once for the same filter.

 

Regards

Hemant

 

 


Viewing all articles
Browse latest Browse all 17645

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>