IPv6 policies allow for this specific type of traffic to travel between the IPv6 and IPv4 networks.

In the Policy section, select the IPv6 Policy checkbox to display this option.

If you are in the Global Database ADOM, select IPv4 Header Policy, IPv4 Footer Policy, IPv6 Header Policy, or IPv6 Footer Policy.

By default, policies will be added to the bottom of the list, but above the implicit policy.

Select to allow traffic to be initiated from the remote site.

You can select to enable or disable the policy in the right-click menu.

If enabled, internet-service-src specifies what the service must NOT be (IPv4 only).

The bypassed MAC address must be received from RADIUS server.

This option decides what IP address will be used to connect server (IPv4 only).

If you are looking to use Incapsula Infrastructure Protection (now Imperva DDoS Protection) it will be helpful to know how they work.

The internets transmission control protocol (TCP) uses the MTU to determine the maximum size of each packet in any transmission.

MTU is usually associated with the Ethernet protocol, where a 1500-byte packet is the largest allowed in it (and hence over most of the internet ).

Each piece is small enough to pass over the single link that it is being fragmented for, using the MTU parameter configured for that interface.

This fragmentation process takes place at the IP layer ( OSI layer 3 ) and marks the packets it fragments as such.

This ensures the IP layer of the destination host knows it should reassemble the packets into the original datagram.

The best way to avoid fragmentation is to adjust the maximum segment size or TCP MSS so the segment will adjust its size before reaching the data link layer.

The total value of the IP and the TCP header is 40 bytes and mandatory for each packet, which leaves us 1460 bytes for our data.

The data size in this packet is 1460, but we can and should decrease it in order to make sure the total size will be 1500 bytes or less.

In the following case for the GRE tunnel, we will set the tcp mss value to be 1436 or lower, while the default size is 1460.

The MSS can be used completely independently in each direction of data flow.

As a result the network devices have the option to rewrite the value of TCP MSS packets that are processed through them.

For example, in a Cisco Router the command ip tcp mss-adjust 1436 in the interface level will rewrite the value of the TCP MSS of any SYN packet that will go via this interface.

Therefore, we need to address the possibility of fragmentation if we are not adjusting the TCP MSS.

Our solution, which is asymmetric by definition (meaning in-bound traffic via Incapsula, outbound traffic via the original ISP) requires us to rewrite the TCP MSS value of SYN packets that are being sent by our protected customer to their end clients.

We can achieve this in a Cisco Router, for example by configuring ip tcp mss-adjust 1436 on the WAN interface or the interface that faces the provider.

Its important to understand that this value will affect the size of the traffic coming from the end client toward the customers server.

This is the traffic that will go via the tunnel and therefore be encapsulated with 24 bytes of GRE.

The outbound traffic, from the customers server toward the end client, goes directly via the original ISP, therefore we dont need to adjust the SYN packets the end user sends as well.

After the three-way handshake is completed and the connection established, the end user will send packets whose data wont exceed the 1420 bytes size.

The reason it doesnt work is because the SYN packets that are sent from the server toward the end user are not going via the GRE tunnel interface, but via the original ISPs interface.

Tcp Mss Fortigate