topic Re: Fragmentation needed ICMP Type 3 Code 4 in Firewall and Security Management

Fragmentation needed ICMP Type 3 Code 4

carl_t — Fri, 06 May 2022 11:56:30 GMT

Hi Guys

We are having some issues with wifi calling over voip, we are seeing the below messages coming from the device in the drop logs

ICMP Fragmentation needed

ICMP Type 3

ICMP Code 4

Address spoofing

Anyone know how to fix this? I believe it could be related to accleration.

Cheers

Carl

Re: Fragmentation needed ICMP Type 3 Code 4

Chris_Atkinson — Fri, 06 May 2022 12:25:35 GMT

Does the traffic traverse a VPN and have you checked for MTU issues?

Meanwhile Anti-spoofing implies traffic is coming into an interface that the source address isn't expected from.

Re: Fragmentation needed ICMP Type 3 Code 4

carl_t — Fri, 06 May 2022 13:03:20 GMT

Hi Chris

The interface it is coming in on is fine, It does not traverse a vpn, it is traffic just going out of the internet.

Re: Fragmentation needed ICMP Type 3 Code 4

carl_t — Mon, 09 May 2022 07:09:01 GMT

Any ideas guys ?

Re: Fragmentation needed ICMP Type 3 Code 4

Chris_Atkinson — Mon, 09 May 2022 07:25:44 GMT

More information is likely required for us to be of much help here.

- Is there anything special about the internet connection used: Satellite / LTE / PPPoE ?

- Which version and jumbo hotfix is applied to the gateway?

- What is the Wireless network topology with respect to both the firewall & client device.

Back in the day Wi-Fi environments utilizing CAPWAP or similar between an AP and WLC used to necessitate either the use of jumbo frames or adjust-mss in the intermediate network to address fragmentation issues.

Re: Fragmentation needed ICMP Type 3 Code 4

carl_t — Mon, 09 May 2022 07:42:00 GMT

It is a normal 1G ethernet internet connection.

These are Meraki wifi controllers located at our main site where the internet connection is, the access points tunnel traffic back to them and it breaks out locally on the lan, then goes to the internet from there.

The Gateways are on R80.20 Take 47.

Re: Fragmentation needed ICMP Type 3 Code 4

Maarten_Sjouw — Mon, 09 May 2022 11:18:41 GMT

if you can use a smal free program called TCPoptimizer you can try to find out what the end to end MTU setting is. It is always better to prevent fragmentation and when your internet connection is using pppoe it will take out 8 bytes of the standard packet size. Then you can setup MSS clamping to make sure this will be handled properly. (keep in mind MSS is 40 bytes lower than MTU)

Re: Fragmentation needed ICMP Type 3 Code 4

G_W_Albrecht — Mon, 09 May 2022 11:34:59 GMT

R80.20 will be out of support in September, GA Jumbo is 205, Ongoing Jumbo is 211 - installed take 47 went GA on 25.3.2019...