FCSS_EFW_AD-7-4 practice question 5 of 15

A company's users on an IPsec VPN between FortiGate A and B have experienced intermittent issues since implementing VXLAN. The administrator suspects that packets exceeding the 1500-byte default MTU are causing the problems. In which situation would adjusting the interface’s maximum MTU value help resolve issues caused by protocols that add extra headers to IP packets?

Answer options

A: Adjust the MTU on interfaces only if FortiGate has the FortiGuard enterprise bundle, which allows MTU modification.

B: Adjust the MTU on interfaces in all FortiGate devices that support the latest family of Fortinet SPUs: NP7, CP9 and SP5.

C: Adjust the MTU on interfaces in controlled environments where all devices along the path allow MTU interface changes. Correct answer

D: Adjust the MTU on interfaces only in wired connections like PPPoE, optic fiber, and ethernet cable.

Correct Answer:

C. Adjust the MTU on interfaces in controlled environments where all devices along the path allow MTU interface changes.

Explanation

When using IPsec VPNs and VXLAN, additional headers are added to packets, which can exceed the default 1500-byte MTU. This can lead to fragmentation issues, dropped packets, or degraded performance. To resolve this, the MTU (Maximum Transmission Unit) should be adjusted only if all devices in the network path support it. Otherwise, some devices may still drop or fragment packets, leading to continued issues. Why adjusting MTU helps:
● VXLAN adds a 50-byte overhead to packets.
● IPsec adds additional encapsulation (ESP, GRE, etc.), increasing the packet size.
● If packets exceed the MTU, they may be fragmented or dropped, causing intermittent connectivity issues.
● Lowering the MTU on interfaces ensures packets stay within the supported size limit across all network devices.

Keep practicing

Take the free FCSS_EFW_AD-7-4 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test