Undecrypted packets are dropped due to MTU size exceeded
18321
Created On 01/26/22 00:39 AM - Last Modified 08/09/22 02:35 AM
Symptom
When trying to access some websites an error as the following is observed:
When reviewing the counters using "show counter global", packet dropped due to MTU exceeded messages are seen
Global counters:
Elapsed time since last sampling: 13.256 seconds
name value rate severity category aspect description
----------------------------------------------------------------------------------
pkt_sent 3 0 info packet pktproc Packets transmitted
flow_fwd_ip_df_drop 1 0 drop flow forward Packets dropped: exceeded MTU but DF bit present <=======
flow_ip_cksm_sw_validation 5 0 info flow pktproc Packets for which IP checksum validation was done in software
One can also confirm the DF (don’t fragment) set to 1 in a packet capture in the IP header:
Environment
- Palo Alto VM-100 Firewall
- PAN-OS 10.0
- TCP/UDP traffic
Resolution
- One solution that can be tried in this scenario is adjusting the Maximum Segment Size (MSS) size.
- Adjusting the MSS size will ensure that longer headers do not result in a packet length that exceeds the allowed MTU. If the DF bit were set and the MTU is exceeded, the larger packets would be dropped.
Adjusting MSS:
- GUI: Network > Interfaces > select Ethernet, VLAN, or Loopback
- Select Advanced > Other Info
- Select Adjust TCP MSS and enter a value for one or both of the following:
- IPv4 MSS Adjustment Size
- IPv6 MSS Adjustment Size
- Click on OK and commit the changes