Reassembling fragmented packets

FortiGates with NP7 processors that are licensed for hyperscale firewall features support reassembling fragmented packets in sessions offloaded to the NP7 processors.

To support reassembling fragmented packets, the NP7 processor hash-config can be set to src-dst-ip or src-ip. As well, NP7 ip-reassemly must be enabled. You can also adjust the ip-reassembly minimum and maximum timeouts. The currently recommended configuration includes the following minimum and maximum timeouts. You can adjust these timeouts for your network configuration and traffic profile.

config system npu

set hash-config {src-dst-ip | src-ip}

config ip-reassembly

set status enable

set min_timeout 64

set max_timeout 200000

end

For more information about the hash-config option, see hash-config {src-dst-ip | src-ip}.

For more information on the ip-reassembly option, see Reassembling and offloading fragmented packets