Helpful ReplyHot!HELP - FortiOS 5.6 VxLAN encapsulation within IPsec - VLAN Trunking

Author
Tim_86
New Member
  • Total Posts : 14
  • Scores: 0
  • Reward points: 0
  • Status: offline
2018/11/07 08:33:40 (permalink) 5.6
0

HELP - FortiOS 5.6 VxLAN encapsulation within IPsec - VLAN Trunking

Hi everybody,
 
I've got a question about vxlan, in FortiOS 5.6 I've found the following.
  • FortiOS 5.4 VxLAN encapsulation within IPsec only supports forwarding untagged frames
  • Are tagged frames within the IPSEC/VXLAN supported in version 5.6? 
  • Kind regards,
    Tim
     
post edited by tim@clnw.nl - 2018/11/07 08:39:19
#1
tanr
Platinum Member
  • Total Posts : 639
  • Scores: 21
  • Reward points: 0
  • Joined: 2016/05/09 17:09:43
  • Status: offline
Re: HELP - FortiOS 5.6 VxLAN encapsulation within IPsec - VLAN Trunking 2018/11/07 09:38:23 (permalink)
0
Per https://travelingpacket.com/2017/09/28/fortigate-vxlan-encapsulation/ vlan trunking over VXLAN works in 5.6.2 and later.  Haven't tried it myself though.
#2
Tim_86
New Member
  • Total Posts : 14
  • Scores: 0
  • Reward points: 0
  • Status: offline
Re: HELP - FortiOS 5.6 VxLAN encapsulation within IPsec - VLAN Trunking 2018/11/07 23:47:32 (permalink)
0
Hi,
 
Thanks for your reply, I've installed FortiOS 6.0 and I can see the vlan tags go through the tunnel/vxlan.
But I'm running into a major issue, the connection is incredibly slow.
Internet pages load in about a minute and pings to the internet shows packet loss
.
The issue only exists when the traffic comes from a trunk, it works fine from a single vlan (accessport).
 
This might be an issue with MTU or TCP MSS but I can't seem to pinpoint which value to change.
 
The MTU on the interfaces? MSS on the IPSEC tunnel?
I've tried different values(as low as 1300) but this doesn't seem to solve it. 
We actually need both VLANS going through the IPSEC with VXLAN.
 
Any idea?
 
With kind regards,
Tim
post edited by Tim_86 - 2018/11/07 23:50:17
#3
emnoc
Expert Member
  • Total Posts : 5082
  • Scores: 311
  • Reward points: 0
  • Joined: 2008/03/20 13:30:33
  • Location: AUSTIN TX AREA
  • Status: offline
Re: HELP - FortiOS 5.6 VxLAN encapsulation within IPsec - VLAN Trunking 2018/11/08 01:56:13 (permalink) ☄ Helpfulby Tim_86 2018/11/09 00:56:29
0
 I've tried different values(as low as 1300) but this doesn't seem to solve it. 

 
Try adjusting the  tcp.mss in the policy or at a test host and see if any improvements happens. I would 1st take packet capture and validate the currrent  MSS value  in the SYN or SYN/ACK. I would also sue a ping  with DF set and test the  max size between two hosts over the  ipsec vxlan 
 
i.e 
{ Windows iirc }
ping  -m -s 1400  x.x.x.x
 
{macosx }
ping -D  -s 1400  x.x.x.x
 
{ linux }
 
ping -M do -s 1400 x.x.x.x
 
Ken

PCNSE,  NSE , Forcepoint ,  StrongSwan Specialist
#4
gangadar1234
New Member
  • Total Posts : 4
  • Scores: 0
  • Reward points: 0
  • Joined: 2018/11/15 19:57:47
  • Status: offline
Re: HELP - FortiOS 5.6 VxLAN encapsulation within IPsec - VLAN Trunking 2018/11/15 20:04:39 (permalink)
0
yes it is, i have tested in the LAB  and  i see the firewall is passing the tags
#5
Jump to:
© 2018 APG vNext Commercial Version 5.5