how i get fragmented ip packets in my vnet?

Moty Evroni 0

i dont get fragment packets from out of vnet

GitaraniSharma-MSFT 49,701 Reputation points Microsoft Employee

2023-09-18T11:10:41.55+00:00

Hello @Moty Evroni ,

Welcome to Microsoft Q&A Platform. Thank you for reaching out & hope you are doing well.

I understand that you are unable to get fragment packets from out of your Azure Vnet.

Could you please provide more details about your issue?

To get a generic idea of fragmentation in Azure, you can refer the below doc:

https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-tcpip-performance-tuning

The Azure Virtual Network stack will attempt to fragment a packet at 1,400 bytes.

Virtual Network stack is set up to drop "out of order fragments," that is, fragmented packets that don't arrive in their original fragmented order. These packets are dropped mainly because of a network security vulnerability announced in November 2018 called FragmentSmack.

For Azure VPN connections, you must clamp TCP MSS at 1350. Or if your VPN devices don't support MSS clamping, you can alternatively set the MTU on the tunnel interface to 1400 bytes instead.

Refer: https://learn.microsoft.com/en-us/azure/vpn-gateway/vpn-gateway-about-vpn-devices#ipsec

For ExpressRoute, the maximum transmission unit (MTU) for the interface is 1500, which is the typical default MTU for an Ethernet interface on a router. Unless your router has a different MTU by default, there's no need to specify a value on the router interface. Unlike an Azure VPN gateway, the TCP maximum segment size (MSS) for an ExpressRoute circuit doesn't need to be specified.

Refer: https://learn.microsoft.com/en-us/azure/expressroute/expressroute-config-samples-routing#mtu-and-tcp-mss-settings-on-router-interfaces

Regards,

Gita
Moty Evroni 0 Reputation points

2023-09-19T12:12:12.8933333+00:00

I used TCP connection to overcome my issue.

my issue was in transfer large SIP INVITE packets - 2000 bytes - between 2 different azure Vnet which connect with peering.
Moty Evroni 0 Reputation points

2023-09-19T12:12:43.63+00:00

Thanks on your answer.
GitaraniSharma-MSFT 49,701 Reputation points Microsoft Employee

2023-09-19T14:14:58.47+00:00

@Moty Evroni , thank you for the update. Glad to hear that the issue is now resolved and appreciate much for taking the time to share the resolution. I've summarized the answer below.

1 answer

GitaraniSharma-MSFT 49,701 Reputation points Microsoft Employee

2023-09-19T14:14:02.6433333+00:00

Hello @Moty Evroni ,

I understand that you were unable to get fragmented packets from out of your Azure Vnet.

You were facing issue in transferring large SIP INVITE packets (2000 bytes) between 2 different Azure Vnets which were connected via Vnet peering.

I recommended you refer the below documentation to get a generic idea of fragmentation in Azure:

https://learn.microsoft.com/en-us/azure/virtual-network/virtual-network-tcpip-performance-tuning

The Azure Virtual Network stack will attempt to fragment a packet at 1,400 bytes.

Virtual Network stack is set up to drop "out of order fragments," that is, fragmented packets that don't arrive in their original fragmented order. These packets are dropped mainly because of a network security vulnerability announced in November 2018 called FragmentSmack.

You provided an update that you were able to resolve your issue by using TCP connection.

Thanks for your continued contribution on Q&A and appreciate much for taking the time to share the resolution.

Kindly let us know if you need further assistance on this issue.

Please don’t forget to close the thread by clicking "Accept the answer", as this can be beneficial to other community members.
Please sign in to rate this answer.
Tommy Alex 1 Reputation point

2025-01-26T05:41:22.89+00:00

does this affect packets that are being sent within the same VNET ? i was thinking of a workaround where i would terminate a VPN on VM and then forward the traffic to another VM on the VNET.. ?
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

how i get fragmented ip packets in my vnet?

1 answer

Your answer