MTU Drops from 1400 to 1200 Causing AVS VM Connectivity Loss

Hi Kaushal, Pravesh

Thank you for reaching out. Based on your description, the issue appears to be related to MTU mismatch and path MTU discovery in your AVS architecture. When traffic passes through the Site-to-Site VPN and Azure Firewall, additional encapsulation overhead reduces the effective MTU, causing it to drop from 1400 to 1200. This behavior is common when intermediate devices enforce lower MTU values.

1. Check Intermediate Network Devices: Ensure that there are no devices along the path (like your VPN or Azure Firewall) that have a lower MTU configuration which could lead to fragmentation and ultimately force a lower MTU setting.
2. Verify MTU Settings on VMs:
   • For Azure VMs, the default MTU is typically set to 1500, but you have the ability to increase it. Based on your setup, make sure that the MTU settings are consistently configured across all involved systems.
   • You can check the current MTU value on Windows using PowerShell:

          Get-NetIPInterface
     

   • To set a specific MTU value, use:

          Set-NetIPInterface -InterfaceAlias "Ethernet" -NIMtuBytes 3892
     

     Ensure to replace the MTU value with what’s appropriate for your configuration.
3. Path MTU Discovery: Use tools like Test-Connection to diagnose path MTU issues. This will help confirm what the effective MTU is across the path:

      Test-Connection -TargetName <DestinationIP> -MtuSize
   

4. Check Connections and Firewalls: Make sure there are no firewall rules that might be limiting traffic, causing packet fragmentation. Also, check the VM network configuration, ensuring the correct IP address and subnet mask are in use, and the right distributed port group is assigned.
5. Consider Network Extensions: If you are using HCX network extensions, verify their MTU settings. Misconfigured MTUs here can also lead to that connectivity loss you're experiencing.

Make sure to apply and test these changes during a maintenance window to avoid disruption.

If you're still facing issues after these checks, here are some follow-up questions that could help gather more details:

• Have you modified any settings recently on the Azure Firewall or the VPN that might correlate with when the drops began?
• Can you confirm if other VMs in AVS also experience similar issues, or is it isolated to specific instances?
• Did you perform any recent maintenance or changes to the routing tables or security groups that could impact connectivity?
• Are there any specific applications or services on the VMs that are particularly sensitive to MTU changes?
• Relevant Documentation:
• Configure Maximum Transmission Unit (MTU) for virtual machines in Azure
• Create HCX network extension
• HCX Site Pair connectivity diagnostics

Hope this helps! Please let me know if you have any queries in comments.