topic Re: Possible R81 bug with MTU change? in General Topics

Possible R81 bug with MTU change?

the_rock — Tue, 13 Jul 2021 14:50:55 GMT

Hey everyone,

Has someone seen this issue in R81? I did this on 2 firewalls and changed mtu from 1500 to 1350 or 1400 and as soon as I did that, lost ssh and web gui. I NEVER had this issue in R77.30 and before.

Could this be a bug??

Re: Possible R81 bug with MTU change?

PhoneBoy — Tue, 13 Jul 2021 18:43:05 GMT

Were you able to reconnect?
I wouldn’t be surprised if there was an interaction here with SecureXL.

Re: Possible R81 bug with MTU change?

the_rock — Tue, 13 Jul 2021 18:45:49 GMT

Hey D,

I was able to reconnect once I changed it back to 1500. Even disabling sxl does not make any difference once you change mtu to 1350 or 1400.

Re: Possible R81 bug with MTU change?

PhoneBoy — Tue, 13 Jul 2021 19:01:25 GMT

Could be related to MSS which may also need to be changed.
See: https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk61221&partition=Advanced&product=IPSec

Re: Possible R81 bug with MTU change?

the_rock — Tue, 13 Jul 2021 19:05:53 GMT

Maybe, not real sure, but did this many times before R80 and never ever did I have to change mss or anything else once I changed mtu size, it simply worked.

Re: Possible R81 bug with MTU change?

Ilya_Yusupov — Wed, 14 Jul 2021 11:31:44 GMT

Hi @the_rock,

Can you share which type of appliance is in use and which type of interface it is?

Thanks,

Ilya

Re: Possible R81 bug with MTU change?

Gareth_somers — Wed, 14 Jul 2021 13:31:47 GMT

Only really an aside but I've had issues like this related to MTU and encrypted sessions (HTTPS etc.), Generally it's where the MTU is forced but the client does not know about it and sends larger packets with the DF bit set. You can test this by lowering the MTU on the client device and see can you connect. Normally adjust-mss and path MTU discovery are required for the client to negotiate the correct MTU if you're not directly connected on the same Layer 2 subnet.

Re: Possible R81 bug with MTU change?

the_rock — Wed, 14 Jul 2021 13:49:44 GMT

I did not use physical appliance, as I dont have any on R81, this was only VM testing.

Re: Possible R81 bug with MTU change?

Ilya_Yusupov — Wed, 14 Jul 2021 13:54:45 GMT

In my lab on VM it is working fine.

Do you see any failures/errors under /var/log/messages?

Re: Possible R81 bug with MTU change?

the_rock — Thu, 15 Jul 2021 13:50:44 GMT

Nothing of interest in messages at all. I think we can park this issue for now, since we dont plan on upgrading any customers to R81 code on firewalls as of yet any time soon. I was just doing some tests myself for VPN tunnel with cloud provider, hence the reason why I had to change MTU size.

Re: Possible R81 bug with MTU change?

Ilya_Yusupov — Thu, 15 Jul 2021 13:55:21 GMT

How you reduce the MTU? via clish or via ifconfig?

Re: Possible R81 bug with MTU change?

the_rock — Thu, 15 Jul 2021 14:24:36 GMT

Hi...tried both via web UI and clish, same results.