IKE fragmentation example
This section provides an example of a non-default IPsec VPN configuration. You can use this configuration if FortiClient fails to connect to IPSec VPN, and you see the following symptoms:
- When you view the FortiGate IKE debug log and the FortiClient debug log, they show that FortiClient fails at phase-1.
- Packet capture shows that FortiGate sends some IKE packets with a packet length that is longer than the usual Ethernet packet with regards to MTU, but FortiClient does not receive those packets.
In this case, you can try IKE fragmentation. You must make changes to the FortiGate and FortiClient configurations.
To configure FortiGate:
-
Enable IKE fragmentation on FortiGate using the following FortiOS CLI:
config vpn ipsec phase1-interface
edit <your IPSec VPN>
set fragmentation enable
To configure FortiClient:
- Enable IKE fragmentation on FortiClient using XML:
<ipsecvpn>
<connections>
<connection>
<name>your IPSec VPN</name>
<ike_settings>
<enable_ike_fragmentation>1</enable_ike_fragmentation>