Forum Discussion

Neo_Ph's avatar
Neo_Ph
Icon for Altocumulus rankAltocumulus
May 09, 2024

VPN fragmented IP packets dropped

VPN fragmented IP packets being dropped by the Big-IP, because of 'tm.minipfragsize > default=552' (K52103592)  TCPDump showed the ip packets arriving on the client-side and never being forwarded on ...
irule
minipfragsize
more fragment
Neo_Ph's avatar
Neo_Ph
Icon for Altocumulus rankAltocumulus

There's a VPN tunnel in the picture, that is forcing the MTU to 1400 -- hence why we get packets with less than 552bytes & with the MF set.
I agree that performance might become an issue.  What would be a good option is: to limit performance problems by creating a new VS for all remote VPN sites, with the same pool members. The iRule would only be used on that new dedicated VS for remote VPN sites traffic only. 
Thanks for your feedback.

zamroni777's avatar
zamroni777
Icon for Nacreous rankNacreous
May 16, 2024

default ethernet mtu is 1500 bytes.
the 100 bytes difference to vpn's 1400 might be cause of the small fragment.

enabling jumbo frame 9000 bytes mtu on physical interface means adjacent switch/router will less likely to send fragmented payload to the f5.

  • Neo_Ph's avatar
    Neo_Ph
    Icon for Altocumulus rankAltocumulus
    May 17, 2024

    I agree for the jumbo frames.  Despite having jumbo frames on the path, when packets goes through the VPN, we have to force the MTU to 1400.