> Source: [sk121114](https://support.checkpoint.com/results/sk/sk121114)

# sk121114 - "Fragmentation needed" error on dropped packets sent through tunnel on Spark Firewall

| Property | Value |
|----------|-------|
| Solution ID | sk121114 |
| Date Created | 2017-10-25 |
| Last Modified | 2026-02-18 |
| Technical Level | General |
| Products | Spark Firewall (Locally Managed) |
| Versions | R81.10.X |
| Platform | 1500, 1600, 1800, 910 |

## Symptoms

- * Packets sent through the VPN tunnel are dropped with the `Fragmentation needed` error.
* Packets sent through the VPN tunnel are dropped with the following error: `
  VPN peer third party
  ;[fw4_0];fw_log_drop_ex: Packet proto=6 10.132.136.19:50494 -> 10.129.3.104:65122 dropped by fw_first_packet_state_checks Reason: First packet isn't SYN;`

## Cause

Packets were sent with a higher MSS than is set on the other site.

## Solution

Configure the MSS clamping on the appliance:

1. In CLI, configure the required values for the applicable kernel parameters:

   1. Connect to the command line on the appliance.

   2. Log in to the Expert mode:

      `expert`
   3. Back up the current configuration file:

      `cp -v $FWDIR/modules/fwkern.conf{,_BKP}`
   4. Configure the required values for the kernel parameters:

      1. `echo "fw_allow_out_of_state_post_syn=1" >> $FWDIR/modules/fwkern.conf`

      2. `echo "fw_allow_out_of_state_icmp=1" >> $FWDIR/modules/fwkern.conf`

      3. `echo "fw_icmp_redirects=1" >> $FWDIR/modules/fwkern.conf`

      4. `echo "fw_clamp_tcp_mss=1" >> $FWDIR/modules/fwkern.conf`

2. In WebUI, configure the required settings:

   1. Connect to WebUI on the appliance.

   2. Configure the required Advanced Settings:

      1. From the left navigation panel, click **Device**.

      2. In the **Advanced** section, click **Advanced Settings**.

      3. In the top field, search for:

         **Stateful Inspection - Accept out of state TCP packets**
      4. Select this setting and click **Edit**.

      5. In the field **Accept out of state TCP packets** , change the value to 1 and click **Apply**.

      6. In the top field, search for:

         **VPN Site to Site global settings - Keep DF flag on packet**
      7. Select this setting and click **Edit**.

      8. Select **Keep DF flag on packet** and click **Apply**.

   3. Configure the MTU on the **WAN** port to 1400:

      1. From the left navigation panel, click **Device**.

      2. In the **Network** section, click **Internet**.

      3. Below the Internet connection, click **Edit**.

      4. From the top, click the **Advanced** tab.

      5. Select **Use custom MTU value**.

      6. Enter the value **1400**.

      7. Click **Apply**.

   4. Configure the MTU on the **LAN** port(s) to 1400:

      1. From the left navigation panel, click **Device**.

      2. In the **Network** section, click **Local Network**.

      3. Select the LAN interface and click **Edit**.

      4. From the top, click the **Advanced** tab.

      5. In the field **MTU Size** , enter the value **1400**.

      6. Click **Apply**.

3. Reboot the appliance.

<br />

**Related Solutions:**

* [sk62482 - How to debug VPN issues on Quantum Spark (SMB) Appliances](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk62482)

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content