County overlay workloads black-hole large packets after a ToR change. Geneve-encapsulated frames are dropped, and NSX-T security looks down even though Manager and Distributed Firewall rules are unchanged. Underlay MTU on the new ToR is 1500. What should the administrator fix?
Select an answer to reveal the explanation.
Short Explanation
Geneve is a thick envelope. If the physical ToR only accepts 1500-byte postcards, those envelopes get shredded and everyone swears NSX is down. Bump MTU hop-by-hop on the underlay; rewriting DFW will not shrink Geneve.
Full Explanation
NSX-T overlay uses Geneve encapsulation, which requires underlay MTU large enough for the extra header, commonly 1600 or 1700 bytes end-to-end. A ToR left at 1500 silently drops or fragments overlay frames, which presents as workload connectivity and security-path failure even when NSX Manager and Distributed Firewall configuration are intact. Recreating DFW, disabling Carbon Black Cloud sensors, or moving controls to Workspace ONE Access does not fix underlay MTU. Coordinate with LAN engineers to set and verify Geneve-adequate MTU on every hop between TEPs.