Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I tested my dns servers with the oarc test and my size limit is at least 1403 bytes. I performed the same test before my Juniper ISG 2000 and the result is 2047 bytes.

According to the chapter IP "Fragments Filtered" and this article, I think I have a fragmentation problem.

This article talks about ip virtual-reassembly for cisco but I can't find the equivalent for Juniper.

I prefer to find the good option in JunOS before I talk about this with my net admin :-)


share|improve this question

The ISG-2000 is actually a stateful firewall with several other features and options (VPN, IPS, etc.). It runs not JunOS but ScreenOS, as it's a NetScreen firewall.

Assuming you're running ScreenOS 6.2.0 or newer, you should be able to enable IP packet reassembly as follows:

set flow force-ip-reassembly
share|improve this answer

From what I can tell, there is no option on things other than GRE tunnels, and possibly all tunnels.

Is there any chance of using a stateful firewall, as I believe that may also enable reassembly?

share|improve this answer
Yes, it seems a stateful firewall is the only solution if you insist on having a firewall:… "To ward against attacks that use fragmentation, the JUNOS stateful firewall supports virtual reassembly for TCP and UDP packets,..." – bortzmeyer Apr 16 '10 at 6:59

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.