Forum Discussion
Abed_AL-R
Cirrostratus
CirrostratusICMP (Fragmentation needed) Between Firewall and LTM
We have been working for a while with Fortinet about an issue between the firewall and the LTM (r10600 with tenant 15.1.9.1), this issue is causing a loop with some ICMP packets. The flow goes like ...
zamroni777
MVP
MVPit seems the packet comes from fw to f5 with DF (dont fragment) bit flag enabled in IP header while f5 needs to fragment it before sending to client.
the df bit might not set by fw but by node in front of fw.
you can configure fortinet to respect/honor the df flag or not and see which one works in your network.
config system global
set honor-df enable/disable <- Enabled by default.
Abed_AL-RThank you.
The honor-df is indeed set to enable. I tried if disabling it help, but it did not.
