County overlay workloads black-hole large packets after a ToR change. Geneve-encapsulated frames are dropped, and NSX-T security looks down even though Manager and Distributed Firewall rules are unchanged. Underlay MTU on the new ToR is 1500. What should the administrator fix?

When county overlay workloads black-hole large packets after a ToR change, Geneve-encapsulated frames are dropped, and NSX-T security looks down even though Manager and Distributed Firewall rules are unchanged, raise underlay MTU end-to-end so Geneve overlay frames are not dropped or fragmented. An underlay left at 1500 after ToR change cannot carry oversized GENEVE frames, so overlay and security functions appear broken despite unchanged policy. Fixing civic underlay MTU restores the fabric. Recreating every Distributed Firewall section so rules compress into 1500-byte Geneve frames fails by concept because DFW section recreation does not shrink GENEVE headers to fit a 1500 underlay. Disabling Carbon Black Cloud sensors on overlay VMs so endpoint traffic no longer needs jumbo frames fails by concept because CBC sensors are unrelated to underlay MTU for GENEVE. Moving identity firewall to Workspace ONE Access network ranges so name-based allows avoid the overlay fails by concept because Access network ranges do not fix underlay MTU black-holing of overlay frames. Exam caveat: unchanged DFW with Geneve drops after ToR change means underlay MTU end-to-end—not rewriting DFW, disabling CBC, or moving to Access ranges. Operational check: set underlay and VDS MTU to the overlay design value across ToRs, retest large-packet and TEP connectivity, confirm security services recover, and lock MTU standards in the county datacenter build guide for municipal NSX operations.