Solution

从前边的方法可以看出，在6.4/7.0版本中，通过FortiGate自行处理、开启ipv4-df，FortiGate都有可能因为ESP/UESP报文超过物理口的MTU而产生ESP/UESP分片。那么还有什么办法呢？

通过Override Tunnel接口的MTU，我们可以强制指定Tunnel接口的MTU值。

config system interface
    edit "ToR2"
        **set mtu-override enable**
        **set mtu 1400**
    next
end

<aside> 💡 该功能在6.4版本开始支持，参考Mantis ID 0611391。

</aside>

<aside> 💡 同时需要注意，6.4/7.0 GA版本，如果是Hub-Spoke模型，FortiGate开启net-device的情况下，动态生成的Tunnel接口（如ToR2_0）不会继承Tunnel mtu-override的MTU值，参考Mantis ID 0744598，Tunnel interface MTU settings does not work when net-device is enabled in phase1。目前（2021.12.15）GA版本未修复该问题。

</aside>

参照有问题的算法AES256-SHA256 (NAT-T)，在Tunnel接口开启mtu-override，看问题是否得以解决。

Topology

Untitled

Basic Configuration

FW1

R1-FG1101E # show vpn ipsec phase1-interface ToR2
config vpn ipsec phase1-interface
    edit "ToR2"
        set interface "port16"
        set peertype any
        set net-device enable
        set passive-mode enable
        set proposal aes128-sha256
        set **ip-fragmentation pre-encapsulation**
        set remote-gw 100.0.1.2
        set psksecret ENC VB18DBosD7hdTrHDOl21ZJKG5z6BSDgemSX0hmhc8hTn8Y5AMUFZEaWEyXa0VHThkZ/dp7kqZT8lHLbAjphFEvqlHsMuce/Sb11QqEBpNWrLCbHiUJAgZHuvi/iw2ZWv2/GuTr7I4qtTN4M4oHQSsFgrVensTIu6Qk5mNKcmD3LBVT35uQjbZE6IXG+H7dX1AiDGiw==
    next
end
R1-FG1101E # show vpn ipsec phase2-interface ToR2 
config vpn ipsec phase2-interface
    edit "ToR2"
        set phase1name "ToR2"
        set proposal **aes256-sha256**
    next
end

FW2

R2-FG1101E # show vpn ipsec phase1-interface ToR1
config vpn ipsec phase1-interface
    edit "ToR1"
        set interface "port16"
        set peertype any
        set net-device disable
        set exchange-interface-ip enable
        set proposal aes128-sha256
        set **ip-fragmentation pre-encapsulation**
        set dpd disable
        set remote-gw 100.0.0.2
        set psksecret ENC TuwE815+Y0e4BK/OHM1ti6o2H9ORCfcfKdypH970JpGPOICs9KAA00RS807yLN404QeQ/bWMOUTtKEGYXqUfGrh5hgypHVJOLtUlEoTop2ATuJImXAeEufP/JRdkn4ea49HY6PM6SWQ7DDYF3WDYk9edgg11hzf1xG89XkZY9J8KN+6egl07RsTcVLob0WlsObZ2YA==
    next
end
R2-FG1101E # show vpn ipsec phase2-interface ToR1
config vpn ipsec phase2-interface
    edit "ToR1"
        set phase1name "ToR1"
        set proposal **aes256-sha256**
        set replay disable
        set auto-negotiate enable
    next
end

Test Steps

  1. 在Router设备上开启针对FW2的SNAT，将FW2的port16的地址（100.0.3.2）转换为Router的port7的地址（100.0.1.2）。
  2. IPSec VPN隧道建立成功后，我们先来看下两端设备计算出的Tunnel SA/Tunnel Interface的MTU。