FCSS-EFW-AD-7-6: Fortinet NSE 7 - Enterprise Firewall 7.6 AdministratorDemo

By Fortinet · Question Mode

QuestionQ45

VPN

Users in your organization who are connected through an IPsec VPN between FortiGate A and FortiGate B have experienced intermittent issues since VXLAN was implemented. You suspect that packets larger than the default 1500-byte maximum transmission unit (MTU) are causing these problems.

How would adjusting the interface MTU value help resolve issues caused by protocols that add extra headers to IP packets?

  • A Adjust the MTU on interfaces only in wired connections like Point-to-Point Protocol over Ethernet (PPPOE), optic fiber, and Ethernet cable.
  • B Adjust the MTU on interfaces in controlled environments where all devices along the path allow MTU interface changes.
  • C Adjust the MTU on interfaces only on FortiGate A and FortiGate B.
  • D Adjust the MTU on all FortiGate interfaces after adjusting the TCP maximum segment size (MSS).
Explanation

VXLAN encapsulation adds 50 bytes of overhead, and IPsec encapsulation can add further overhead. Increasing an interface MTU can prevent fragmentation or dropped packets only when every device and link on the traffic path supports the larger, consistent MTU; the effective MTU must not exceed the smallest MTU along that path.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!