Description

This article provides an example of the 'Post fragments generated' counter increasing.

Symptoms

The 'Post fragments generated' counter, in the 'show security flow statistics' command output, is increasing.
 

Solution

The technical documentation for the show security flow statistics command provides the following description for the 'Post fragments generated' counter:

For IPsec tunnels, the number of fragments that are received by the SRX Series device and packets that are fragmented after encryption.


Below is an example scenario of the counter incrementing.
 

Topology:

Ubuntu---(ge-0/0/0)SRX1(ge-0/0/1)--IPsec Tunnel---SRX2---PC


Default interface MTU settings for SRX1:

ge-0/0/1 MTU = 1514
ge-0/0/0 MTU = 1514
Ubuntu MTU = 1500

 

Ping from Ubuntu to PC with packet size = 1472:

root@:~# ping 192.168.7.1 -s 1472  -c 10
PING 192.168.7.1 (192.168.7.1) 1472(1500) bytes of data.
1480 bytes from 192.168.7.1: icmp_seq=1 ttl=62 time=11.5 ms
1480 bytes from 192.168.7.1: icmp_seq=2 ttl=62 time=1.55 ms
1480 bytes from 192.168.7.1: icmp_seq=3 ttl=62 time=3.78 ms
1480 bytes from 192.168.7.1: icmp_seq=4 ttl=62 time=4.04 ms
1480 bytes from 192.168.7.1: icmp_seq=5 ttl=62 time=7.48 ms
1480 bytes from 192.168.7.1: icmp_seq=6 ttl=62 time=8.85 ms
1480 bytes from 192.168.7.1: icmp_seq=7 ttl=62 time=4.61 ms
1480 bytes from 192.168.7.1: icmp_seq=8 ttl=62 time=1.70 ms
1480 bytes from 192.168.7.1: icmp_seq=9 ttl=62 time=2.58 ms
1480 bytes from 192.168.7.1: icmp_seq=10 ttl=62 time=2.56 ms


--- 192.168.7.1 ping statistics ---
10 packets transmitted, 10 received, 0% packet loss, time 9014ms
rtt min/avg/max/mdev = 1.556/4.874/11.555/3.176 ms



SRX1 Security Flow Stats:

root# run show security flow statistics    
    Current sessions: 5
    Packets received: 60
    Packets transmitted: 30
    Packets forwarded/queued: 10
    Packets copied: 20
    Packets dropped: 0
    Fragment packets: 20
    Pre fragments generated: 0
Post fragments generated: 20  <<<<<<<<<<<<<<<<<<<<<<<<<<<<<<



Explanation:
  1. SRX1 receives packet destined to go thru the VPN.
  2. SRX1 encrypts packet.
    If the encrypted packet size is greater than the egress physical interface MTU, the SRX will fragment the ESP packets, and the Post fragments generated counter will increment.