The 911 compute cluster will carry Geneve overlay, but the N-VDS still uses a 1500-byte MTU. What should be configured before relying on later DFW or Traceflow results?
Select an answer to reveal the explanation.
Short Explanation
Geneve is extra wrapping on every box; a 1500-byte door shreds the package. Bump host-switch and underlay MTU first so later DFW or Traceflow is not a wild-goose chase for a simple size problem.
Full Explanation
Geneve overlay on the 911 compute cluster needs host-switch and underlay MTU raised above 1500 so encapsulated frames are not dropped or fragmented. Until MTU is correct, later Distributed Firewall and Traceflow results are contaminated by simple size problems on the underlay path.
Leaving MTU at 1500 and assuming DFW will pad Geneve is false—DFW does not fix underlay MTU. Lowering guest MTU to 512 is an extreme workaround that does not replace proper host-switch and fabric MTU design. Ignoring host-switch MTU and treating every drop as a DFW miss wastes incident time on the wrong plane.
Exam caveat: fix Geneve MTU before deep firewall troubleshooting when overlay is in play.
Operational check: raise N-VDS/host-switch and underlay MTU per design, verify large-frame connectivity between TEPs, re-run Traceflow for a 911 conversation, then trust DFW hit counts only after MTU is clean.
MTU debt on 911 overlay turns every firewall ticket into a haunted house. After raising host-switch and underlay MTU, run large-packet tests between TEPs, re-baseline Traceflow for a CAD conversation, and require MTU evidence in any future “DFW drop” incident before analysts rewrite micro-segmentation rules.