Encrypted Traffic Fails Due to MTU Mismatch Between Physical and Virtual Hosts

Resolving The Problem

Option 1: Standardize MTU to 1500 (Recommended for Mixed Environments)

On all DSE hosts with MTU 9000:

# Temporary change (lost on reboot)
sudo ip link set <interface> mtu 1500

# Permanent change - RHEL/CentOS 7/8/9
sudo vi /etc/sysconfig/network-scripts/ifcfg-<interface>
# Add or modify:
MTU=1500

# Restart network
sudo systemctl restart NetworkManager
# or
sudo nmcli connection down <connection> && nmcli connection up <connection>

# Verify
ip link show <interface> | grep mtu

For Ubuntu/Debian:

# Edit netplan configuration
sudo vi /etc/netplan/01-netcfg.yaml

# Add MTU setting:
network:
  version: 2
  ethernets:
    ens192:
      mtu: 1500
      # ... other settings

# Apply
sudo netplan apply

Option 2: Increase VMware MTU to 9000 (If Infrastructure Supports Jumbo Frames)

Requirements:

• All switches and routers in path must support jumbo frames
• Physical NICs must support MTU 9000
• May require network team coordination

On VMware ESXi:

# Set vSwitch MTU
esxcli network vswitch standard set -v vSwitch0 -m 9000

# Set VMkernel interface MTU
esxcli network ip interface set -i vmk0 -m 9000

# Verify
esxcli network vswitch standard list

On Virtual Machines:

• Follow same steps as Option 1, but set MTU to 9000
• Reboot VM or restart network service

Option 3: Configure Path MTU Discovery (Workaround)

# Enable PMTU discovery on Linux hosts
sudo sysctl -w net.ipv4.ip_no_pmtu_disc=0

# Make permanent
echo "net.ipv4.ip_no_pmtu_disc=0" | sudo tee -a /etc/sysctl.conf
sudo sysctl -p

Note: This is a workaround and may not fully resolve the issue if intermediate devices don't properly handle ICMP "Fragmentation Needed" messages.

Verification

1. Test DSE Internode Encryption

# Enable encryption in cassandra.yaml
server_encryption_options:
    internode_encryption: all

# Restart DSE
sudo systemctl restart dse

# Check logs for successful connections
grep -i "ssl\|handshake" /var/log/cassandra/system.log

# Verify with nodetool
nodetool status

2. Test SSH Connection

# SSH with verbose output
ssh -vvv user@remote_host

# Should complete without hanging at KEX_ECDH_REPLY

3. Test with OpenSSL

# Test SSL handshake
openssl s_client -connect <remote_host>:7001 -showcerts

# Should complete handshake and show certificate chain

Prevention

1. Standardize MTU across all datacenters
   • Document MTU requirements in infrastructure standards
   • Use consistent MTU (1500 or 9000) across physical and virtual environments
2. Validate MTU during host provisioning
   • Add MTU check to deployment automation
   • Include in pre-production validation checklist
3. Monitor MTU settings
   • Add MTU monitoring to infrastructure monitoring tools
   • Alert on MTU mismatches between connected hosts
4. Document network topology
   • Maintain documentation of MTU settings per datacenter
   • Include in network diagrams and runbooks