Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Adjust MSS calculation to account for VLANs

    Scheduled Pinned Locked Moved L2/Switching/VLANs
    55 Posts 5 Posters 3.6k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • V
      virtual-frog @RobbieTT
      last edited by

      @RobbieTT you're not listening.

      The problem is that ICMP messages are arriving on the WAN side of my firewall and not making it to the VLAN side to return to my PC. So my PC just keeps sending packets not knowing someone is unhappy about the MTU.

      VLANs are related somehow because I don't get these fragmentation messages without them.

      RobbieTTR 1 Reply Last reply Reply Quote 0
      • RobbieTTR
        RobbieTT @virtual-frog
        last edited by

        @virtual-frog

        I have no problem knocking on your door with full-sized packets and getting the same in return:

         2023-06-14 at 20.20.59.png

        Did you try without the switch?

        ☕️

        V 1 Reply Last reply Reply Quote 0
        • V
          virtual-frog @RobbieTT
          last edited by

          @RobbieTT Right, and I can reach the internet just fine through the switch, on an untagged port. If the switch was a problem, wouldn't the VLAN packet capture still show the ICMP frag messages leaving the firewall? I haven't observed any issues between my PC and firewall.

          If nothing else comes up I can try taking out the switch this evening.

          M 1 Reply Last reply Reply Quote 0
          • M
            michmoor LAYER 8 Rebel Alliance @virtual-frog
            last edited by michmoor

            @virtual-frog

            10.0.1.0/24 - LAN1
            192.168.20.0/24 - LAN2

            For devices on LAN2 network which are having issues

            1. Dont believe this to be the case but are they configured for jumbo frames?
            2. Move devices from LAN2 to LAN1. Are they still having the issue or does it go away?

            What is the MTU set on pfSense for each interface.

            Firewall: NetGate,Palo Alto-VM,Juniper SRX
            Routing: Juniper, Arista, Cisco
            Switching: Juniper, Arista, Cisco
            Wireless: Unifi, Aruba IAP
            JNCIP,CCNP Enterprise

            V 1 Reply Last reply Reply Quote 0
            • V
              virtual-frog @michmoor
              last edited by

              @michmoor

              I have not configured jumbo frames on any devices, although it seems the switches are configured by default to handle 1518 (the minimum jumbo size).

              In your example is LAN1 the parent interface or another VLAN? pfSense MTU and MSS are at defaults now, i.e. 1500/1460.

              1 Reply Last reply Reply Quote 0
              • JKnottJ
                JKnott @michmoor
                last edited by

                @michmoor said in Adjust MSS calculation to account for VLANs:

                I assume VLAN2 on the switch, what is the MTU of the switch ports for devices connected to VLAN2?

                Do switches even have an MTU setting? That's a layer 3 concept. Switches have a maximum buffer size, but that's a lot larger than you'll likely find in an MTU. I have a switch with a 16KB buffer size. It will pass any frame up to that size.

                PfSense running on Qotom mini PC
                i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                UniFi AC-Lite access point

                I haven't lost my mind. It's around here...somewhere...

                V RobbieTTR 2 Replies Last reply Reply Quote 0
                • JKnottJ
                  JKnott @virtual-frog
                  last edited by

                  @virtual-frog said in Adjust MSS calculation to account for VLANs:

                  there is a jumbo frame option that is set to 1518

                  That's barely frame expansion, to allow things like VLAN tags. Jumbo frames are several KB, with 9000 common.

                  PfSense running on Qotom mini PC
                  i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                  UniFi AC-Lite access point

                  I haven't lost my mind. It's around here...somewhere...

                  V 1 Reply Last reply Reply Quote 0
                  • V
                    virtual-frog @JKnott
                    last edited by

                    @JKnott said in Adjust MSS calculation to account for VLANs:

                    Do switches even have an MTU setting? That's a layer 3 concept.

                    Well, an L3 switch might.. mine is not so it just has the jumbo frame size

                    1 Reply Last reply Reply Quote 0
                    • V
                      virtual-frog @JKnott
                      last edited by

                      @JKnott said in Adjust MSS calculation to account for VLANs:

                      @virtual-frog said in Adjust MSS calculation to account for VLANs:

                      there is a jumbo frame option that is set to 1518

                      That's barely frame expansion, to allow things like VLAN tags. Jumbo frames are several KB, with 9000 common.

                      It's the same setting; I can adjust it much higher but haven't set up jumbo frame on my devices yet. The default is 1518

                      johnpozJ 1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator @virtual-frog
                        last edited by

                        @virtual-frog said in Adjust MSS calculation to account for VLANs:

                        haven't set up jumbo frame on my devices yet.

                        no point to it either.. You think you having issues now - wait til you try and do that when you have devices that don't support jumbo or have different sizes, etc..

                        if you had a san network running say 10ge and you had storage devices and say server all on this san network ok then it might make sense - but there is really zero point to trying to do it on a normal gig network.. To be honest I would turn that feature off on your switch..

                        Not sure where you got the idea that those icmp packets saying to frag would or should go to your end device - how would it??

                        You are sending those.. Not ddg..

                        unreach.jpg

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                        V 1 Reply Last reply Reply Quote 0
                        • V
                          virtual-frog @johnpoz
                          last edited by

                          @johnpoz
                          D'oh. My bad. But that makes even less sense. Why does WAN send the frag message for only packets originating on the VLAN?

                          johnpozJ 1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator @virtual-frog
                            last edited by johnpoz

                            @virtual-frog you have something all f'd up on that vlan would be my guess. So the mtu on the interface is 1500? What about your clients, are they wired or is wireless involved..

                            No idea about that tp link when it comes to vlans - they don't seem to quite get it ;) A few years back they had an issue where they would not allow you to remove vlan 1 from any ports.. So if you wanted to run say vlan 10 on that port, you were also untagged in vlan 1.. Took them like 2 years to correct it..

                            Why does WAN send the frag message for only packets originating on the VLAN?

                            Its not it sending it because what ddg is sending back.. A full packet seems to be too big for your vlan?? Even though the client sent a mss of 1460.. you can see that from the syn you sent.

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                            V RobbieTTR 2 Replies Last reply Reply Quote 0
                            • V
                              virtual-frog @johnpoz
                              last edited by

                              @johnpoz

                              Yes, all MTUs are the default 1500.
                              Mix of wired and wireless, same effect on both.
                              TP Link seems to have matured somewhat (still not perfect) so I don't think there's some huge flaw in the switch.
                              It's strange that this only happens with one site, too.
                              I may reset and reinstall everything.

                              johnpozJ RobbieTTR 2 Replies Last reply Reply Quote 0
                              • johnpozJ
                                johnpoz LAYER 8 Global Moderator @virtual-frog
                                last edited by johnpoz

                                @virtual-frog I am not having any issues with that site, via tagged vlans.. Than again I am not running on tplink ;)

                                Did you try just turning off jumbo support?

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 24.11 | Lab VMs 2.7.2, 24.11

                                JKnottJ 1 Reply Last reply Reply Quote 0
                                • RobbieTTR
                                  RobbieTT @virtual-frog
                                  last edited by

                                  @virtual-frog
                                  Are you not going to try removing the switch from the equation by going direct to the router for fault finding purposes?

                                  Ruling these things in or out takes seconds of self-help.

                                  ☕️

                                  1 Reply Last reply Reply Quote 0
                                  • RobbieTTR
                                    RobbieTT @johnpoz
                                    last edited by

                                    @johnpoz said in Adjust MSS calculation to account for VLANs:

                                    @virtual-frog you have something all f'd up on that vlan would be my guess.

                                    I'd probably not use that phrasing but I agree that this looks to be a local network issue.

                                    ☕️

                                    1 Reply Last reply Reply Quote 1
                                    • RobbieTTR
                                      RobbieTT @JKnott
                                      last edited by

                                      @JKnott said in Adjust MSS calculation to account for VLANs:

                                      Do switches even have an MTU setting? That's a layer 3 concept.

                                      🙌 I think you just outed yourself as a fellow greybeard. For sure that was once the case and still referenced in some documentation but many (and disparate*) changes undermined that. Indeed, we were probably looking at switches with awe back then, as we nursed our hubs along.

                                      Our distinction now is that in the context of Layer 2 switches the larger MTU is referenced with specific regard to jumbo frames and these are solely at L2.

                                      At Layer 3 (network layer) the larger MTU is used in the context of jumbo packets. This is before we drift-off to sleep with oversized L3 MTU jumbo packets being jumbograms.

                                      A few things don't matter and most things don't matter at all.

                                      👍

                                      ☕️

                                      *some would argue that the word 'haphazard' should be inserted here

                                      JKnottJ 1 Reply Last reply Reply Quote 0
                                      • JKnottJ
                                        JKnott @johnpoz
                                        last edited by

                                        @johnpoz said in Adjust MSS calculation to account for VLANs:

                                        Did you try just turning off jumbo support?

                                        What would that do? It only affects the size of frame the switch will pass. It has nothing to do with MTU.

                                        PfSense running on Qotom mini PC
                                        i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                        UniFi AC-Lite access point

                                        I haven't lost my mind. It's around here...somewhere...

                                        johnpozJ 1 Reply Last reply Reply Quote 0
                                        • JKnottJ
                                          JKnott @RobbieTT
                                          last edited by

                                          @RobbieTT said in Adjust MSS calculation to account for VLANs:

                                          At Layer 3 (network layer) the larger MTU is used in the context of jumbo packets

                                          I am aware of that. However, did the OP mention anything about a L3 switch? Are there any consumer level L3 switches. I have a switch that can pass 16K jumbo frames and, IIRC, there's no setting for that. It's just there and will pass any frames up to that size. Of course, with 1500 MTU, it won't see many that big.

                                          PfSense running on Qotom mini PC
                                          i5 CPU, 4 GB memory, 32 GB SSD & 4 Intel Gb Ethernet ports.
                                          UniFi AC-Lite access point

                                          I haven't lost my mind. It's around here...somewhere...

                                          RobbieTTR 1 Reply Last reply Reply Quote 0
                                          • RobbieTTR
                                            RobbieTT @JKnott
                                            last edited by

                                            @JKnott I specifically said at the network layer. Nobody has mentioned any L3 features being used down at the data link layer.

                                            In answer, there are very few consumer/prosumer switches with any L3-like capabilities. I have a couple of them but the L3 options are so badly implemented that I don't use them in that role.

                                            ☕️

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.