How does the Palo Alto Networks Firewall Manage Fragmented Traffic?

Publisher

Palo Alto Networks

URL

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClXXCA0

Published

2024-11-20

Updated

unknown

Accessed

2026-10-02

HTTP status

200

License

Palo Alto Networks website terms; no-redistribution; short excerpts and locators only

Source notes citing this source

• PAN-OS global counters for fragments include flow_ipfrag_recv, flow_ipfrag_merge and flow_ipfrag_frag, plus flow_fwd_ip_df for packets dropped because DF was set and MTU was exceeded. in context
• Palo Alto Networks firewalls reassemble fragmented traffic for content inspection only and then forward it fragmented according to the egress interface MTU. in context

Cite this source record

APA

WarmTransfer. (2024, November 20). How does the Palo Alto Networks Firewall Manage Fragmented Traffic?. WarmTransfer. https://warmtransfer.net/knowledge/sources/paloalto-kb-fragmented-traffic

BibTeX

@misc{warmtransfer-paloalto-kb-fragmented-traffic,
  title  = {How does the Palo Alto Networks Firewall Manage Fragmented Traffic?},
  author = {{WarmTransfer}},
  year   = {2024},
  url    = {https://warmtransfer.net/knowledge/sources/paloalto-kb-fragmented-traffic},
  note   = {Palo Alto Networks, accessed 2026-10-02}
}