topic Re: Fragment Reassembly Time Exceeded Errors in General Topics

Fragment Reassembly Time Exceeded Errors

Rccou — Thu, 05 Mar 2020 12:59:56 GMT

I have 2 RADIUS servers that are trying to talk to each other through a Checkpoint R80.30 ClusterXL.

It seems to be failing with a lot of errors in the logs saying "Fragment_time_exceeded" traffic dropped.

I have tried to allow all ICMP between the end clients but there is no PMTUD taking place and there doesn't seem to be a way to enable this traffic to fragment and reassemble without failing with these errors.

We have all the latest hotfixes required. Is there a reason for this?

Re: Fragment Reassembly Time Exceeded Errors

G_W_Albrecht — Thu, 05 Mar 2020 13:40:35 GMT

If this was a connection using VPN i would have cried MTU, MTU! But this looks different. Maybe still the following can help: sk98074: MTU and Fragmentation Issues in IPsec VPN

Re: Fragment Reassembly Time Exceeded Errors

Ilya_Yusupov — Thu, 05 Mar 2020 17:31:14 GMT

Please check under GuiDBedit "icmperrors", by default it should be allowed "true" looks like in your case the policy not allowing it, if it false change it to true and recheck.

Re: Fragment Reassembly Time Exceeded Errors

RCCO — Fri, 06 Mar 2020 10:13:43 GMT

I made this change, but I am still getting the same error. I made the change on the management server - is this correct or did it need to get made on the firewalls themselves?

Yesterday I have also added an exception to the inspection settings for traffic between the 2 RADIUS servers in case this was the problem. It seemed to make it a little bit better but I still see the error and still have problems.

Thanks

Re: Fragment Reassembly Time Exceeded Errors

Ilya_Yusupov — Sun, 08 Mar 2020 08:31:24 GMT

it should be done via guidbedit and then push policy, see attached

if you did it and still have an issue i suggest to open TAC case.