VPNs fail when transferring large packets

[BarryStiefel]

VPNs fail when transferring large packets



Some applications set the "Don't Fragment" bit on certain packets. When the IPSEC headers are added onto the already large packet, the packet basically requires fragmentation in order to pass. When Check Point creates the IPSEC packet, the Don't Fragment bit it passed onto the new packet. The end result, a packet that requires fragmentation to pass, but has the Don't Fragment bit set, so can't be fragmented. Packet gets dropped.





Answer In FireWall-1 NG, you can force FireWall-1 to clear the Don’t Fragment bit by changing the ipsec_dont_fragment property in objects_5_0.C to false. You do this with the following commands in dbedit on the management console (craig is the firewall in this example) or use GUIdbedit to change the parameter:



dbedit> modify network_objects craig VPN:ipsec_dont_fragment false dbedit> update network_objects craig

For Solaris In FireWall-1 4.1, you can force FireWall?-1 to clear the Don't Fragment bit by setting the fw_ipsec_dont_fragment kernel variable as follows:

set fw:fw_ipsec_dont_fragment=0x0To make this change without rebooting:

echo "fw_ipsec_dont_fragment?w 0x0" | adb -w -k /dev/ksyms /dev/mem

For HPUX 9 Use the following command and reboot the gateway:

# echo "fw_ipsec_dont_fragment?W0" | adb -w /hp-ux

For HPUX 10 Use the following command and reboot the gateway:

# echo "fw_ipsec_dont_fragment?W0" | adb -w /stand/vmunix

For AIX Use the following commands:

# fwstop # echo "fw_ipsec_dont_fragment?W0" | adb -w $FWDIR/modules/fwmod.4.x.o # fwstart

For Windows NT I do not know how to make this change on NT.

Editors Note: If someone discovers how to do this - please let us know.

For IPSO (VPN-1 Appliance or Nokia IPxxx), you will need to get the 'modzap' utility from Resolution 1261 in Nokia's Knowledge Base. You can then use the following command line to modify the fwhmem parameter and reboot the system:

# modzap -s _fw_ipsec_dont_fragment $FWDIR/modules/fwmod.o 0x0

For Linux Add the following to $FWDIR/boot/modules/fwkern.conf and restart FireWall?-1:

fw_ipsec_dont_fragment=0



-- RobertGraham - 14 Jan 2004

FAQForm FAQs.Class: EncryptionFAQs FAQs.OS: OsAIX, OsSolaris, OsNokiaIPSO, OsHpux, OsLinux FAQs.Version: