SRX inbound MTU is 1500 and outbound MTU towards the Radius server is 9k and when IDP is enabled radius stops working

Radius access request packet not seen on SRX next device on customer end

Scenario 1: When MTU is 9k and IDP is enabled.

• We receive fragmented Radius packets from the client and on SRX since IDP is enabled it will reassemble the packets for inspection. Once the IDP inspection is done it will send this reassembled packet out of the SRX. This packet size of more than 2k was sent out of SRX as MTU on that interface is 9k.
• F5 device connected to SRX does not have jumbo frame support enabled. Hence it is dropping the packets

Scenario 2: When IDP is disabled with MTU 9K

• When fragmented packets come to SRX it will not reassemble it, as IDP is not on. Hence, will send the same packets out of SRX, which has a packet size of less than 1500 and passes through F5.

Note: This is true for any traffic where SRX has to reassemble the fragments for flow processing (e.g SIP, Q.931, H.245, etc). After the processing, SRX can send a reassembled full packet out depending upon the MTU of egress interface. This can cause issues in certain cases where any devices in the middle strictly allow packet of size maximum 1500 bytes. In such cases you can force the SRX to preserve the fragment size before transmitting it out using the below given CLI knob:

>set security flow preserve-incoming-fragment-size

This will choose the fragment size based on the minimum (MTU of ingress interface, MTU of egress interface).