Question 350

Only The First Fragment

A stateless firewall is configured to permit UDP destination port 4789 and deny everything else. A 4000-byte VXLAN datagram arrives at a 1500-byte-MTU link and is fragmented into three IPv4 fragments.

What does the firewall see, and what does it have to decide?

A

Fragments 2 and 3 carry the port numbers in an IP option added by the fragmenting router, precisely so that stateless filters keep working.

B

Only fragment 1 carries the UDP header, so fragments 2 and 3 have no port to match; the firewall must either admit all non-initial fragments or drop them, and dropping them destroys the datagram.

C

Every fragment repeats the UDP header so reassembly can be done at any hop, so all three match the rule and pass.

D

The firewall reassembles the datagram before applying rules, which is why fragmentation is a performance problem rather than a policy problem.