So to came back to the topic question: it will be usefull to manually set the MTU of a virtual VPN interface.Configure a Maximum Transmission Unit (MTU) Value It is not sese to have differente MTU beetwen the two endpoint because it is a virtual layer 2. When I say 'fortigate should share the MTU information with the other side' this will help and a VPN tunnel for definition is a connection beetween two point without anything in the middle. The other case is pMTUd fail that cause a packet size very very low. The fragmentation case is the more frequent and will cause a very low transfer if you sum this with the very high latency of SAT connection. In any case the server will never know that pMTU is lower. But when the IPSEC packet traverse the GRE TUNNEL the router should advise FGT Central (source IP of IPSEC packet) that MTU is lower (if DF set) and the router drop the packet (if DF ignore not used), OR the router do fragmentation (if DF not set). For the packets from server to client FGT central can tell to the server that the maximum packet size is 1446 and not 1500 (PMTUD) and the server adjust the MSS. Check this: server -> FGT Central -> VPN -> GRE -> FGT Remote -> client Central site: physical interface MTU 1500, VPN virtual MTU 1446 Remote site (SAT): physical interface MTU 1476, VPN virtual MTU 1412 Both side client and server have MTU 1500, so they choose TCP MSS of 1460. When there is a VPN and GRE path mtu discovery fail. e.g 1500 1514 1518 could all mean 1500 bytes with the later showing the ( 802.1q overhead to confuse matter even more ) GRE always has a minimum of 24bytes overhead since this is what you have a calculated 1476 NOTE: If you run GRE over-ipse you even have more overhead. Keep mind to ignore most report interfaces MTU size & when you have a mix of devices that ever body report slightly different numbers. The result is your path-MTU between those 2 end-points. What you should do is to run a ping or mtu-ping with the 'DF' bit set (1 = don't frag ) and see the max size packet that's able to be sent. keep in mind ICMP packets are not a sure thing and more so with firewall or other devices dropping imp. MTU sizing is also not bi-symmetrical to begin with hence why icmppath-discovery was created. what do you mean by 'share MTU', the vpn is a layer3 concept & a MTU is a layer2 ethernet frame nothing to share.

The fortigate should share the MTU information with the other side and choose the minimum.

Tcp mss fortigate