The edge's lrouter port does not sent out icmp error too large for tcp packet larger than then MTU with DF bit

Products

• VMware NSX

Issue/Introduction

• The edge's lrouter port does not return ICMP type3 code 4 packets when it receives a tcp packet with its MTU size exceeded and the DF bit set.
• The source VM is not able adjust packet size based on icmp error message, and the destination VM will receive large tcp packet without being fragmented.
• In the case of UDP and ICMP packets, even if a packet exceeding the MTU of the lrouter port is received, ICMP Type3 Code4 is returned from the Edge, so the MTU is automatically adjusted by the source VM.

Environment

VMware NSX-T Data Center 3.X
VMware NSX 4.X

Cause

The NSX Edge was designed so that the logical router does not adjust the MTU for efficient TCP processing, and TCP packets were bypassed regardless of the MTU size defined for the NSX logical port.

Resolution

Currently, there is no resolution.

 

Workarounds:

• To prevent packet drops due to MTU size overflow, set the MTU size of the source VM to stay within the MTU size range of the devices on the route.

Additional Information

Impact/Risks:

• TCP traffic can be dropped by physical switches and routers due to the size of the packets.