This article explains an issue where the SRX does not preserve the fragmentation characteristics of the received packets while forwarding those out to an upstream device.

In a transit traffic scenario, if the Maximum Transmission Unit (MTU) of the ingress interface on an SRX device is set to its default value of 1500 bytes, while the MTU of the egress interface is configured to a higher value, such as 9216 bytes, the SRX may encounter fragmented packets at its ingress interface. This fragmentation occurs due to the MTU limitation on the ingress direction of the network segment. When the SRX receives these fragmented packets, it will reassemble them into a larger packet before sending them out through the interface with the higher MTU.

• In many application layer services like IDP, Application-identification, ALG, SIP etc SRX reassembles the fragmented packets before deep packet inspection checks and if the MTU of the egress interface is set to values like 9216, it does not fragment the packet again before forwarding it to the upstream device instead it forwards the reassembled full-size packet. This is an expected behaviour.
• This can cause issues sometimes especially if the upstream devices in the path cannot handle packets with size bigger than 1500 bytes and might end of dropping these jumbo packets. In such cases we can configure the SRX to preserve the fragmentation characteristics of the incoming packets, so that it fragments the reassembled packet before forwarding. We can add below given config knob to achieve this:

User@SRX#set security flow preserve-incoming-fragment-size

2026-03-10 : Article Created

2026-09-28 : Non-Tech changes