Fortinet black logo

Administration Guide

IPv6 tunnel inherits MTU based on physical interface

IPv6 tunnel inherits MTU based on physical interface

The MTU of an IPv6 tunnel interface is calculated from the MTU of its parent interface minus headers.

Example

In this topology, FortiGate B and FortiGate D are connected over an IPv6 network. An IPv6 tunnel is formed, and IPv4 can be used over the IPv6 tunnel. The tunnel interface MTU is based on the physical interface MTU minus the IP and TCP headers (40 bytes). On FortiGate B's physical interface port5, the MTU is set to 1320. The IPv6 tunnel is based on port5, and its MTU value of 1280 is automatically calculated from the MTU value of its physical interface minus the header. The same is true for port3 on FortiGate D.

To verify the MTU for the IPv6 tunnel on FortiGate B:
  1. Configure port5:
    config system interface
        edit "port5"
            set vdom "root"
            set type physical
            set snmp-index 7
            config ipv6
                set ip6-address 2000:172:16:202::1/64
                set ip6-allowaccess ping
            end
            set mtu-override enable
            set mtu 1320
        next
    end
  2. Configure the IPv6 tunnel:
    config system ipv6-tunnel
        edit "B_2_D"
            set source 2000:172:16:202::1
            set destination 2000:172:16:202::2
            set interface "port5"
        next
    end
  3. Configure the tunnel interface:
    config system interface
        edit "B_2_D"
            set vdom "root"
            set ip 172.16.210.1 255.255.255.255
            set allowaccess ping https http
            set type tunnel
            set remote-ip 172.16.210.2 255.255.255.255
            set snmp-index 33
            config ipv6
                set ip6-address 2000:172:16:210::1/64
                set ip6-allowaccess ping
                config ip6-extra-addr
                    edit fe80::2222/10
                    next
                end
            end
            set interface "port5"
        next
    end
  4. Verify the interface lists:
    # diagnose netlink interface list port5
    if=port5 family=00 type=1 index=13 mtu=1320 link=0 master=0
    ref=68 state=start present fw_flags=0 flags=up broadcast run multicast
    Qdisc=mq hw_addr=**:**:**:**:**:** broadcast_addr=**:**:**:**:**:**
    stat: rxp=1577 txp=1744 rxb=188890 txb=203948 rxe=0 txe=0 rxd=0 txd=0 mc=825 collision=0 @ time=1631647112
    re: rxl=0 rxo=0 rxc=0 rxf=0 rxfi=0 rxm=0
    te: txa=0 txc=0 txfi=0 txh=0 txw=0
    misc rxc=0 txc=0
    input_type=0 state=3 arp_entry=0 refcnt=68
    
    # diagnose netlink interface list B_2_D
    if=B_2_D family=00 type=769 index=41 mtu=1280 link=0 master=0
    ref=25 state=start present fw_flags=0 flags=up p2p run noarp multicast
    Qdisc=noqueue local=0.0.0.0 remote=0.0.0.0
    stat: rxp=407 txp=417 rxb=66348 txb=65864 rxe=0 txe=61 rxd=0 txd=0 mc=0 collision=60 @ time=1631647126
    re: rxl=0 rxo=0 rxc=0 rxf=0 rxfi=0 rxm=0
    te: txa=0 txc=0 txfi=0 txh=0 txw=0
    misc rxc=0 txc=0
    input_type=0 state=3 arp_entry=0 refcnt=25
To verify the MTU for the IPv6 tunnel on FortiGate D:
  1. Configure port3:
    config system interface
        edit "port3"
            set vdom "root"
            set type physical
            set snmp-index 5
            config ipv6
                set ip6-address 2000:172:16:202::2/64
                set ip6-allowaccess ping
            end
            set mtu-override enable
            set mtu 1320
        next
    end
  2. Configure the IPv6 tunnel:
    config system ipv6-tunnel
        edit "D_2_B"
            set source 2000:172:16:202::2
            set destination 2000:172:16:202::1
            set interface "port3"
        next
    end
  3. Configure the tunnel interface:
    config system interface
        edit "D_2_B"
            set vdom "root"
            set ip 172.16.210.2 255.255.255.255
            set allowaccess ping https http
            set type tunnel
            set remote-ip 172.16.210.1 255.255.255.255
            set snmp-index 36
            config ipv6
                set ip6-address 2000:172:16:210::2/64
                set ip6-allowaccess ping
                config ip6-extra-addr
                    edit fe80::4424/10
                    next
                end
            end
            set interface "port3"
        next
    end
  4. Verify the interface lists:
    # diagnose netlink interface list port3
    # diagnose netlink interface list D_2_B

IPv6 tunnel inherits MTU based on physical interface

The MTU of an IPv6 tunnel interface is calculated from the MTU of its parent interface minus headers.

Example

In this topology, FortiGate B and FortiGate D are connected over an IPv6 network. An IPv6 tunnel is formed, and IPv4 can be used over the IPv6 tunnel. The tunnel interface MTU is based on the physical interface MTU minus the IP and TCP headers (40 bytes). On FortiGate B's physical interface port5, the MTU is set to 1320. The IPv6 tunnel is based on port5, and its MTU value of 1280 is automatically calculated from the MTU value of its physical interface minus the header. The same is true for port3 on FortiGate D.

To verify the MTU for the IPv6 tunnel on FortiGate B:
  1. Configure port5:
    config system interface
        edit "port5"
            set vdom "root"
            set type physical
            set snmp-index 7
            config ipv6
                set ip6-address 2000:172:16:202::1/64
                set ip6-allowaccess ping
            end
            set mtu-override enable
            set mtu 1320
        next
    end
  2. Configure the IPv6 tunnel:
    config system ipv6-tunnel
        edit "B_2_D"
            set source 2000:172:16:202::1
            set destination 2000:172:16:202::2
            set interface "port5"
        next
    end
  3. Configure the tunnel interface:
    config system interface
        edit "B_2_D"
            set vdom "root"
            set ip 172.16.210.1 255.255.255.255
            set allowaccess ping https http
            set type tunnel
            set remote-ip 172.16.210.2 255.255.255.255
            set snmp-index 33
            config ipv6
                set ip6-address 2000:172:16:210::1/64
                set ip6-allowaccess ping
                config ip6-extra-addr
                    edit fe80::2222/10
                    next
                end
            end
            set interface "port5"
        next
    end
  4. Verify the interface lists:
    # diagnose netlink interface list port5
    if=port5 family=00 type=1 index=13 mtu=1320 link=0 master=0
    ref=68 state=start present fw_flags=0 flags=up broadcast run multicast
    Qdisc=mq hw_addr=**:**:**:**:**:** broadcast_addr=**:**:**:**:**:**
    stat: rxp=1577 txp=1744 rxb=188890 txb=203948 rxe=0 txe=0 rxd=0 txd=0 mc=825 collision=0 @ time=1631647112
    re: rxl=0 rxo=0 rxc=0 rxf=0 rxfi=0 rxm=0
    te: txa=0 txc=0 txfi=0 txh=0 txw=0
    misc rxc=0 txc=0
    input_type=0 state=3 arp_entry=0 refcnt=68
    
    # diagnose netlink interface list B_2_D
    if=B_2_D family=00 type=769 index=41 mtu=1280 link=0 master=0
    ref=25 state=start present fw_flags=0 flags=up p2p run noarp multicast
    Qdisc=noqueue local=0.0.0.0 remote=0.0.0.0
    stat: rxp=407 txp=417 rxb=66348 txb=65864 rxe=0 txe=61 rxd=0 txd=0 mc=0 collision=60 @ time=1631647126
    re: rxl=0 rxo=0 rxc=0 rxf=0 rxfi=0 rxm=0
    te: txa=0 txc=0 txfi=0 txh=0 txw=0
    misc rxc=0 txc=0
    input_type=0 state=3 arp_entry=0 refcnt=25
To verify the MTU for the IPv6 tunnel on FortiGate D:
  1. Configure port3:
    config system interface
        edit "port3"
            set vdom "root"
            set type physical
            set snmp-index 5
            config ipv6
                set ip6-address 2000:172:16:202::2/64
                set ip6-allowaccess ping
            end
            set mtu-override enable
            set mtu 1320
        next
    end
  2. Configure the IPv6 tunnel:
    config system ipv6-tunnel
        edit "D_2_B"
            set source 2000:172:16:202::2
            set destination 2000:172:16:202::1
            set interface "port3"
        next
    end
  3. Configure the tunnel interface:
    config system interface
        edit "D_2_B"
            set vdom "root"
            set ip 172.16.210.2 255.255.255.255
            set allowaccess ping https http
            set type tunnel
            set remote-ip 172.16.210.1 255.255.255.255
            set snmp-index 36
            config ipv6
                set ip6-address 2000:172:16:210::2/64
                set ip6-allowaccess ping
                config ip6-extra-addr
                    edit fe80::4424/10
                    next
                end
            end
            set interface "port3"
        next
    end
  4. Verify the interface lists:
    # diagnose netlink interface list port3
    # diagnose netlink interface list D_2_B