topic Re: FTDv Jumbo Frames in Network Security

FTDv Jumbo Frames

stamperbrian — Sun, 11 Apr 2021 16:43:13 GMT

I'm messing around in lab and trying to get the FTDv to do jumbo frames. According to the documentation its pretty simple but I've not had any luck. I set the MTU on the Interface to 9000 and FMC said it was enabling jumbo frames and to reboot. I deployed, rebooted.

ping -l 11484 -f works but anything larger than 1484 fails. Any other hosts on this same vnic/vswitch like my 9800v WLC, windows boxes, etc. all work fine up to 8xxx. Any idea's? Thoughts? I can't find anything to say this doesn't work with the FTDv.

Re: FTDv Jumbo Frames

a.sizov99 — Thu, 23 Mar 2023 12:54:43 GMT

Have the same issue.. Any reply or suggestions on how to verify would be helpfull..

Re: FTDv Jumbo Frames

tvotna — Fri, 24 Mar 2023 09:59:42 GMT

Jumbo support is implemented in the underlying Lina (ASA) code. One of my colleagues faced with a similar issue on ASAv some time ago and found that ASAv doesn't allocate memory blocks during reboot properly on all ASAv variants below ASAv100. For to-the-box traffic (and few other special cases) check "show blocks". If you see "1" in the MAX column for 9344 blocks, the allocation is incorrect and to-the-box ping and OSPF may not work. FAILED counter will increment. For through-the-box traffic also check "show blocks interface". Also check "show jumbo-frame reservation".

Then another issue was found which affects all ASAv including ASAv100: large frames were dropped by ESXi due to MTU Check Enforcement: "In ESXi version 6.7 update 2 and later, the default behavior of the platform is enforced to perform a MTU check on the receiving path and will not allow packets that are larger than the vNIC's MTU size". Not sure if this is relevant for your case though.

HTH