Load balancing TCP, UDP, and ICMP sessions with fragmented packets

If your FortiGate 7000E receives fragmented TCP, UDP, or ICMP packets, you can use the following configuration to make sure the Internal Switch Fabric (ISF) handles them correctly.

config load-balance setting

set dp-fragment-session enable

set sw-load-distribution-method src-dst-ip

end

With this configuration, when the DP processor receives a header fragment packet, if a matching session is found, the DP processor creates an additional fragment session matching the source-ip, destination-ip, and IP identifier (IPID) of the header fragment packet. Subsequent non-header fragments will match this fragment session and be forwarded to the same FPM as the header fragment.

If dp-fragment-session is disabled (the default), handling fragmented packets is less efficient because the DP processor broadcasts all non-header fragmented TCP, UDP, or ICMP packets to all FPMs. FPMs that also received the header fragments of these packets re-assemble the packets correctly. FPMs that did not receive the header fragments discard the non-header fragments.

If sw-load-distribution-method is set to src-dst-ip-sport-dport, fragmented packets may be dropped. Changing the load distribution method to src-dst-ip may lower performance because regular traffic may not be optimally load balanced. You can experiment with enabling and disabling dp-fragment-session and changing sw-load-distribution-method to determine the configuration that produces the best results for your network's traffic.

The age of the fragment session can be controlled using the following command:

config system global

set dp-fragment-timer <timer>

end

The default <timer> value is 120 seconds. The range is 1 to 65535 seconds.