Cannot Access Supervisor API Server URL Due to MTU Mismatch (vSphere Kubernetes Service)

Products

• VMware vCenter Server
• VMware NSX

Issue/Introduction

When attempting to access the Supervisor API Server URL or configure the context using tanzucli commands in a vSphere Kubernetes Service environment, you may experience connection failures. While ICMP pings to the Virtual IP (VIP) on NSX are successful, HTTPS connections (ports 443/6443) fail to respond or complete authentication. This behavior is typically caused by a Path MTU (PMTU) mismatch between the virtual and physical network infrastructure.

Environment

• vCenter Server 8.0
• VMware NSX

Cause

An MTU configuration mismatch exists between the NSX infrastructure and the physical network path. Although the NSX Manager, global network MTU, and physical infrastructure are configured for 9000 MTU, the physical TOR switch VLAN interfaces (e.g., VLAN 200, 210/211) were configured with a standard MTU of 1500 bytes.

Because NSX Edge nodes and the underlying infrastructure are configured for jumbo frames, packets exceeding 1500 bytes traversing these physical VLAN interfaces are fragmented or silently dropped, preventing successful HTTPS communication.

Resolution

Before proceeding, ensure you have appropriate administrative access to the network infrastructure and have scheduled any required maintenance windows to avoid disruption to live traffic.

1. Verify Network Path MTU: Confirm the end-to-end MTU configuration across your physical network switches. Use the following command to test connectivity with larger frame sizes:

   bash

    

   ping -f -l 8972 <VIP_IP_Address>

   If this ping fails while a standard 1500-byte ping succeeds, a path MTU limitation is confirmed.

2. Update Physical Switch Configuration: Coordinate with the network team to update the MTU settings on the affected switch VLAN interfaces (e.g., VLAN 200, 210/211) from 1500 to 9000.

   bash

    

   # Example command structure for Dell OS10 interface configurationinterface vlan <vlan_id>mtu 9000

3. Validate Changes: Once the MTU is updated, verify connectivity again using the large-frame ping test mentioned in Step 1.

4. Test Access: Attempt to access the Supervisor API Server URL or authenticate via tanzucli to ensure HTTPS functionality is restored.

Additional Information

• Troubleshooting MTU issues and fragmentation in NSX fabric
• Contact Broadcom Support
• For further diagnostic logs, collect support bundles from the NSX Edge nodes and ESXi hosts. If the issue persists after correcting physical MTU settings, open a support case with Broadcom providing the results of the jumbo frame ping tests and switch configuration snapshots.