IKEv2 message fragmentation

Large IKEv2 messages (such as authentication exchanges that contain multiple certificates) are fragmented; each message fragment is encrypted and authenticated before being transmitted. On the receiver, the message fragments are verified, decrypted, and merged into the original message. Message fragmentation, as described in RFC 7383, Internet Key Exchange Protocol Version 2 (IKEv2) Message Fragmentation, allows IKEv2 to operate in environments where IP fragments might be blocked and VPN peers would not be able to establish an IPsec security association. IKEv2 message fragmentation is enabled by default on SRX Series devices for IPv4 and IPv6 messages. You can disable fragmentation and, optionally, configure the maximum message size with the fragmentation statement at the [edit security ike gateway gateway-name] hierarchy level.