TCP traffic works fine from end to end, but some traffic, especially HTTPS with large certificate file, gets timeouts

Products

• VMware NSX

Issue/Introduction

• Some TCP traffic (even SSH) works fine from end to end
• Some traffic especially HTTPS with large certification file get hung/timeout 
• We see the browser keeps spinning without getting the web page loaded

To test for this, log into the ESX host and run the following command:

vmkping ++netstack=vxlan -s 1572 -d <destination TEP IP>

If this ping succeeds then the MTU is properly configured.  If the ping fails then a MTU mismatch is present.  

Environment

VMware NSX 

Cause

This issue is caused by a Maximum Transmission Unit (MTU) mismatch between the virtual overlay and the physical network infrastructure.
When a VM sends a packet at the standard Ethernet MTU of 1500 bytes, NSX encapsulates it using the Geneve protocol. This encapsulation adds 68 bytes of overhead. If the physical network (VTEP path) is configured with a 1500-byte MTU, the resulting 1568-byte encapsulated packet exceeds the physical limit and is dropped by switches or routers that do not support fragmentation. Large payloads, such as SSL certificates, often utilize the full MTU, making them the first to fail.

Resolution

To resolve this issue, ensure the physical network infrastructure can accommodate the encapsulated Geneve traffic, configure MTU to 100+ more than VM MTU (if it is 1500 byte then we need to configure 1600 byte)