there is some virtual server that have a problem that packet segment lost when MTU = 1500 so i want to clear DF bit to fix this problem , and how to clear it? thank you

I don't think you can change this behavior directly. Your only option is to lower the MTU on the 'external' VLAN to a suitable value.

let's see this article http://support.f5.com/kb/en-us/solutions/public/6000/000/sol6064.html what about adverse effects when disable Path MTU Discovery enforcement?

The adverse effects are what you are seeing, packets being dropped as they can't be fragmented. PMTU most likely doesn't work through most networks these days because of firewalls and other security measures so I wouldn't be too concerned about turning it off, however, I don't believe it will help either.

PMTU discovery SHOULD work though most networks. If they're installed and maintained by professionals who know what they're doing, and care about not being woken by callouts about strange issues with established connections timing out and dropping. With IPv6 PMTU discovery is pretty much mandatory, or you set your remote MTU to 1280 (?) which is the minimum MTU for IPv6. A better fix would be to find out where the ICMP host unreachables are being dropped and fix it. H

Unfortunately that's not been my experience, particularly where firewalls and router ACLs are concerned. Even where you can control and 'fix' these internally, external and internet sourced connections still present a problem. I've always found it simpler and to be blunt, more reassuring to just drop the VLAN MTU by 160 or so (no great loss). BTW, do you know if disabling PMTU would also stop use of the DF bit? What I've read suggests that may be the case.

How to clear Don't Fragment (DF) bit

nitass
Employee
Jan 17, 2013
sorry, i mean icmp unreachable/fragmentation needed should not be dropped, should it?
What_Lies_Bene1
Cirrostratus
Jan 17, 2013
As Nitass suggests, can you not fix the issue on the router? I believe Cisco ACLs can now be quite granular where ICMP message types are concerned (if it's a Cisco).

Is there a reason this is important to you? PING doesn't seem to like a critical function to me, or is this actually affecting application traffic too?
kridsana
Cirrocumulus
Jan 17, 2013
sorry, i mean icmp unreachable/fragmentation needed should not be dropped, should it?

oh if it's about ICMP fragmentation needed >> F5 receive this packet >> but i didn't found resend packet with new MTU from F5.

Is there a reason this is important to you? PING doesn't seem to like a critical function to me, or is this actually affecting application traffic too?

sorry I mistook this all of time , point is not ping , ping is just show how to test this. customer use tcp normally .
What_Lies_Bene1
Cirrostratus
Jan 17, 2013
Understood, thanks. I assume you did a packet capture to confirm this.

1) Did you see what the 'new' MTU was in the packet?

2) Did the F5 just keep sending packets at the old MTU?

3) Did it eventually remove the DF bit from resent packets?
kridsana
Cirrocumulus
Jan 17, 2013
Posted By What Lies Beneath on 01/17/2013 01:51 AM

Understood, thanks. I assume you did a packet capture to confirm this.

1) Did you see what the 'new' MTU was in the packet?

2) Did the F5 just keep sending packets at the old MTU?

3) Did it eventually remove the DF bit from resent packets?

1. Yes i see only some of them. Most of them is receive ICMP fragmentation needed and nothing happen.

2. no

3. no
What_Lies_Bene1
Cirrostratus
Jan 17, 2013
OK, so what was the MTU provided in the Unreachable packet? Do you know where the lower MTU network is?

Is the router Cisco? If so, could you use the 'ip tcp adjust-mss' command to help here?
nitass
Employee
Jan 17, 2013
oh if it's about ICMP fragmentation needed >> F5 receive this packet >> but i didn't found resend packet with new MTU from F5.i am confused. on page 1, you mention you cannot ping virtual server with mtu 1500. if you ping virtual server, how come does bigip receive icmp unreachable/fragmentation needed??

This problem is client can't ping to virtual server with MTU 1500. it has only one problem virtual server.
kridsana
Cirrocumulus
Jan 17, 2013
i am confused. on page 1, you mention you cannot ping virtual server with mtu 1500. if you ping virtual server, how come does bigip receive icmp unreachable/fragmentation needed??

sorry I mistook this ,after F5 reassemble TCP , it send packet 1500 to client but checkpoint drop it and return ICMP fragmentation needed to F5 with MTU next hop 1476. maybe i focus only ping that customer test show too much.
What_Lies_Bene1
Cirrostratus
Jan 17, 2013
And you have re-enabled PMTU yes?
nitass
Employee
Jan 17, 2013
after F5 reassemble TCP , it send packet 1500 to client but checkpoint drop it and return ICMP fragmentation needed to F5 with MTU next hop 1476.you do see it in tcpdump, don't you? have you provided support the tcdpump? it is C1263209, isn't it? what is the tcpdump filename?