Path MTU Discovery

• When the firewall is translating IPv4 packets in which the DF (don’t fragment) bit is zero, that indicates the sender expects the firewall to fragment packets that are too large, but the firewall doesn’t fragment packets for the IPv6 network (after translation) because IPv6 doesn’t fragment packets. Instead, you can configure the minimum size into which the firewall will fragment IPv4 packets before translating them. The NAT64 IPv6 Minimum Network MTU value is this setting, which complies with RFC 6145, IP/ICMP Translation Algorithm. You can set the NAT64 IPv6 Minimum Network MTU to its maximum value (DeviceSetupSession), which causes the firewall to fragment IPv4 packets to the IPv6 minimum size before translating them to IPv6. (The NAT64 IPv6 Minimum Network MTU does not change the interface MTU.)
• The other method the firewall uses to reduce fragmentation is Path MTU Discovery (PMTUD). In an IPv4-initiated communication, if an IPv4 packet to be translated has the DF bit set and the MTU for the egress interface is smaller than the packet, the firewall uses PMTUD to drop the packet and return an ICMP ‘Destination Unreachable - fragmentation needed’ message to the source. The source lowers the path MTU for that destination and resends the packet until successive reductions in the path MTU allow packet delivery.