Court catalog TEP overlay ping fails after the VDS MTU was left at 1500. Which change restores overlay connectivity?
Select an answer to reveal the explanation.
Short Explanation
Overlay packets wear a GENEVE coat, so 1500 on the VDS is a too-small doorway. Raise MTU on the VDS and the physical path. An Access policy will not stretch frames.
Full Explanation
When court catalog TEP overlay ping fails after the VDS MTU was left at 1500, raise VDS and physical MTU so GENEVE overlay frames fit. Overlay packets carry a GENEVE header, so a 1500-byte VDS MTU is too small a doorway for encapsulated frames and civic catalog TEPs cannot talk. Raising MTU end-to-end on the VDS and physical path restores overlay connectivity without touching identity or endpoint products. Publishing a new Workspace ONE Access policy for the catalog fails by concept because Access SSO policy does not enlarge frame size for GENEVE TEPs. Creating an Identity Firewall rule for TEP addresses fails by concept because IDFW user-to-IP mapping is not an MTU control and will not fix undersized overlay frames. Disabling Distributed Firewall to enlarge the MTU fails by concept because DFW state does not set VDS or physical MTU; disabling it only removes east-west inspection. Exam caveat: GENEVE needs elevated underlay and VDS MTU; do not treat Access, IDFW, or DFW disable as MTU remediation. Operational check: set VDS and physical switch MTU to the overlay design value, retest TEP ping between catalog hosts, confirm overlay services recover, and document the MTU standard in the court datacenter build sheet for municipal NSX operations.