NETWORK PRESENCE ABOUT SERVICES PRODUCTS TRAINING CONTACT US SEARCH SUPPORT
 


Search
display results
words begin  exact words  any words part 

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

RE: [FW1] Ipsec fragmentation on DF packets



I would suspect that your problem is that you are exceeding the MTU of the
ESP tunnel, which I think 24 bytes smaller than your normal IP MTU.  Packets
cannot be fragmented on the ESP tunnell, although there is a Checkpoint
article on how to enable framgmentation over the ESP tunnels.  

I am not sure why the first packet is sent through the tunnel, since
presumably all fragments should be dropped before entering the tunnel.  



-----Original Message-----
From: Frey Sigurjonsson [mailto:[email protected]]
Sent: Monday, September 24, 2001 10:06 AM
To: [email protected]
Subject: [FW1] Ipsec fragmentation on DF packets



Hi,

I've discovered a strange problem with our Firewall-1 (SP4 + RDP +
formatstrings hotfixes) and VPN. When handling large packets with DF bit
set, it fragments the ESP packet but only sends the first fragment. The
other host cannot reassemble the packet and discards it after a timeout.
What could cause it not to send the second fragment, and why the h-ll
does it fragment the packet in the first place?

According to RFC 2401, section 6.1
"In cases where a system (host or gateway) adds an encapsulating
header (ESP tunnel or AH tunnel), it MUST support the option of
copying the DF bit from the original packet to the encapsulating
header (and processing ICMP PMTU messages).  This means that it MUST
be possible to configure the system's treatment of the DF bit (set,
clear, copy from encapsulated header) for each interface.  (See
Appendix B for rationale.)"

I've tried to alter the fw_ipsec_dont_fragment, trying both 1 (true) or
0 (false), it still fragments the packet and only sends the first
fragment.

Anybody got a clue?






============================================================================
====
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
============================================================================
====


**********************************************************************
This email and any files transmitted with it are confidential and
intended solely for the use of the individual or entity to whom they
are addressed. If you have received this email in error please notify
the system manager.

This footnote also confirms that this email message has been swept by
MIMEsweeper for the presence of computer viruses.

www.mimesweeper.com
**********************************************************************



================================================================================
     To unsubscribe from this mailing list, please see the instructions at
               http://www.checkpoint.com/services/mailing.html
================================================================================



 
----------------------------------

ABOUT SERVICES PRODUCTS TRAINING CONTACT US SEARCH SUPPORT SITE MAP LEGAL
   All contents © 2004 Network Presence, LLC. All rights reserved.