A company's users on an IPsec VPN between FortiGate A and B have experienced intermittent issues since implementing VXLAN. The administrator suspects…

When using IPsec VPNs and VXLAN, additional headers are added to packets, which can exceed the

default 1500-byte MTU. This can lead to fragmentation issues, dropped packets, or degraded

performance.

To resolve this, the MTU (Maximum Transmission Unit) should be adjusted only if all devices in the

network path support it. Otherwise, some devices may still drop or fragment packets, leading to

continued issues.

Why adjusting MTU helps:

● VXLAN adds a 50-byte overhead to packets.

● IPsec adds additional encapsulation (ESP, GRE, etc.), increasing the packet size.

● If packets exceed the MTU, they may be fragmented or dropped, causing intermittent connectivity

issues.

● Lowering the MTU on interfaces ensures packets stay within the supported size limit across all

network devices.