This article provides an example of the 'Post fragments generated' counter increasing.
The 'Post fragments generated' counter, in the 'show security flow statistics' command output, is increasing.
The technical documentation for the show security flow statistics command provides the following description for the 'Post fragments generated' counter:
For IPsec tunnels, the number of fragments that are received by the SRX Series device and packets that are fragmented after encryption.
Below is an example scenario of the counter incrementing.
Topology:
Ubuntu---(ge-0/0/0)SRX1(ge-0/0/1)--IPsec Tunnel---SRX2---PC
Default interface MTU settings for SRX1:
ge-0/0/1 MTU = 1514 ge-0/0/0 MTU = 1514 Ubuntu MTU = 1500
Ping from Ubuntu to PC with packet size = 1472:
root@:~# ping 192.168.7.1 -s 1472 -c 10 PING 192.168.7.1 (192.168.7.1) 1472(1500) bytes of data. 1480 bytes from 192.168.7.1: icmp_seq=1 ttl=62 time=11.5 ms 1480 bytes from 192.168.7.1: icmp_seq=2 ttl=62 time=1.55 ms 1480 bytes from 192.168.7.1: icmp_seq=3 ttl=62 time=3.78 ms 1480 bytes from 192.168.7.1: icmp_seq=4 ttl=62 time=4.04 ms 1480 bytes from 192.168.7.1: icmp_seq=5 ttl=62 time=7.48 ms 1480 bytes from 192.168.7.1: icmp_seq=6 ttl=62 time=8.85 ms 1480 bytes from 192.168.7.1: icmp_seq=7 ttl=62 time=4.61 ms 1480 bytes from 192.168.7.1: icmp_seq=8 ttl=62 time=1.70 ms 1480 bytes from 192.168.7.1: icmp_seq=9 ttl=62 time=2.58 ms 1480 bytes from 192.168.7.1: icmp_seq=10 ttl=62 time=2.56 ms
--- 192.168.7.1 ping statistics --- 10 packets transmitted, 10 received, 0% packet loss, time 9014ms rtt min/avg/max/mdev = 1.556/4.874/11.555/3.176 ms
root# run show security flow statistics Current sessions: 5 Packets received: 60 Packets transmitted: 30 Packets forwarded/queued: 10 Packets copied: 20 Packets dropped: 0 Fragment packets: 20 Pre fragments generated: 0 Post fragments generated: 20 <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<