ICMP (Fragmentation needed) Between Firewall and LTM

it seems the packet comes from fw to f5 with DF (dont fragment) bit flag enabled in IP header while f5 needs to fragment it before sending to client.
the df bit might not set by fw but by node in front of fw.

you can configure fortinet to respect/honor the df flag or not and see which one works in your network.

config system global
    set honor-df enable/disable  <- Enabled by default.

Since PMTUD is already enabled and the routing table is correctly configured via dynamic routing protocols (BGP and OSPF), the problem might lie elsewhere. You could start by verifying the settings related to how the F5 LTM handles ICMP error messages using the tmsh show sys icmp-errors command to ensure that the system is not set to drop or mishandle ICMP Type 3, Code 4 messages. Creating specific rules or profiles to handle ICMP traffic, such as using an iRule or modifying the virtual server settings, might help ensure that ICMP messages are properly processed. Although adjusting the TCP MSS might seem risky in an enterprise environment, performing a controlled test during a maintenance window could be a viable option. Alternatively, ensure that the MTU settings on both the firewall and the F5 LTM are correctly configured and consistent. Increasing the debug level for ICMP and PMTUD-related logs temporarily could provide more detailed information to pinpoint why the ICMP messages are being looped. Reviewing the virtual server and pool configurations to ensure proper handling of ICMP traffic and considering a temporary static route for the specific problematic traffic could also help in isolating the issue. While waiting for the upgrade, check for any hotfixes or patches available for your current version (15.1.9.1) that address this specific issue. 

Refer below Article:
https://techdocs.f5.com/kb/en-us/products/big-ip_ltm/releasenotes/related/relnote-supplement-bigip-15-1-9-1.html 

Hello Abed

The issue you're experiencing with ICMP "Fragmentation Needed" messages causing a loop between your Fortinet firewall and the F5 LTM is indeed a challenging one but not uncommon in complex network setups. The problem appears to be related to Path MTU Discovery (PMTUD) and how the F5 LTM handles ICMP "Fragmentation Needed" messages.

Path MTU Discovery (PMTUD) is a mechanism used to determine the maximum transmission unit (MTU) size on the path between two IP hosts, ensuring that IP packets are transmitted without the need for fragmentation. When a packet exceeds the MTU size, an ICMP "Fragmentation Needed" message is sent back to the sender, indicating that the packet needs to be fragmented or resized to fit the MTU.

In your case, it seems that the F5 LTM is not properly handling these ICMP messages and is instead sending them back to the firewall, causing a loop. This can happen if the LTM's routing table or PMTUD configuration is not properly set up to handle these messages.

Enable PMTUD on F5 LTM

tmsh modify sys db tm.pmtud.enable value true

Check and Adjust MTU Settings

tmsh list net interface all-properties

tmsh modify net interface <interface_name> mtu <mtu_value>  -- Adjust the MTU settings if necessary

Update Routing Table

tmsh list net route
tmsh modify net route <route_name> gw <gateway_ip>

Adjust TCP MSS:

tmsh modify sys db tcp.mss value 1460

On Fortinet:

config system interface
edit <interface_name>
set tcp-mss <mss_value>
next
end

Review Relevant Articles: 

https://my.f5.com/manage/s/article/K000138230 

https://my.f5.com/manage/s/article/K13948