A company's users on an IPsec VPN between FortiGate A and B have experienced intermittent...

When using IPsec VPNs and VXLAN, additional headers are added to packets, which can exceed the default 1500-byte MTU. This can lead to fragmentation issues, dropped packets, or degraded performance.

To resolve this, the MTU (Maximum Transmission Unit) should be adjusted only if all devices in the network path support it. Otherwise, some devices may still drop or fragment packets, leading to continued issues.

Why adjusting MTU helps:

● VXLAN adds a 50-byte overhead to packets.

● IPsec adds additional encapsulation (ESP, GRE, etc.), increasing the packet size.

● If packets exceed the MTU, they may be fragmented or dropped, causing intermittent connectivity issues.

● Lowering the MTU on interfaces ensures packets stay within the supported size limit across all network devices.