<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40"><head><META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"><meta name=Generator content="Microsoft Word 12 (filtered medium)"><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
@font-face
{font-family:Tahoma;
panose-1:2 11 6 4 3 5 4 4 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p
{mso-style-priority:99;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:12.0pt;
font-family:"Times New Roman","serif";}
span.EmailStyle18
{mso-style-type:personal;
font-family:"Calibri","sans-serif";
color:#1F497D;}
span.EmailStyle19
{mso-style-type:personal-reply;
font-family:"Calibri","sans-serif";
color:#1F497D;}
.MsoChpDefault
{mso-style-type:export-only;
font-size:10.0pt;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]--></head><body lang=EN-US link=blue vlink=purple><div class=WordSection1><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>In other words, the A10 is simply passing the packets to the server. The A10 isn’t doing anything with them other than translating the destination address of the packet from the VIP to the real server address. It is the real server that is handling the packet (or not). At least that has been my experience with the A10 devices to date.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>So it (the A10) isn’t so much treating the packet incorrectly as the server is probably treating it incorrectly. It could be that the A10 isn’t passing the ICMP packet to the server at all. Do you have tcpdump of the traffic before and after the A10?<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>George<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><div style='border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt'><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> ipv6-ops-bounces+gbonser=seven.com@lists.cluenet.de [mailto:ipv6-ops-bounces+gbonser=seven.com@lists.cluenet.de] <b>On Behalf Of </b>George Bonser<br><b>Sent:</b> Saturday, May 28, 2011 6:49 PM<br><b>To:</b> Cameron Byrne; ipv6-ops@lists.cluenet.de<br><b>Subject:</b> RE: A10 AX fragmentation issue<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Ok, there is another thing to check. If the ICMP packet is being generated from behind a NAT it may not be effective.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>Is this a v4 ICMP packet or a V6 ICMP packet? If it is v4 and if it is being generated from behind NAT, it probably isn’t going to work (ICMP says packet to 10.1.2.3 is too big, balancer says “I don’t have a connection to 10.1.2.3, I have a connection to 123.45.67.89” )<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'>But again, setting that sysctl in the real servers if they are Linux will eliminate the need for ICMP to do PMTUD. ICMP PMTUD should never be expected to work anyway which is why it is not the default mechanism anymore with Windows or Solaris. Too many people block ICMP in their networks or the ICMP is being generated from behind a NAT and contains nonsensical information.<o:p></o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><p class=MsoNormal><span style='font-size:11.0pt;font-family:"Calibri","sans-serif";color:#1F497D'><o:p> </o:p></span></p><div style='border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in 4.0pt'><div><div style='border:none;border-top:solid #B5C4DF 1.0pt;padding:3.0pt 0in 0in 0in'><p class=MsoNormal><b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'>From:</span></b><span style='font-size:10.0pt;font-family:"Tahoma","sans-serif"'> ipv6-ops-bounces+gbonser=seven.com@lists.cluenet.de [mailto:ipv6-ops-bounces+gbonser=seven.com@lists.cluenet.de] <b>On Behalf Of </b>Cameron Byrne<br><b>Sent:</b> Saturday, May 28, 2011 11:54 AM<br><b>To:</b> ipv6-ops@lists.cluenet.de<br><b>Subject:</b> Re: A10 AX fragmentation issue<o:p></o:p></span></p></div></div><p class=MsoNormal><o:p> </o:p></p><p><br>On May 28, 2011 11:14 AM, "Daniel Roesen" <<a href="mailto:dr@cluenet.de">dr@cluenet.de</a>> wrote:<br>><br>> On Sat, May 28, 2011 at 10:07:02AM -0700, George Bonser wrote:<br>> > Is this an A10 issue or is this a problem with ICMP PMTU discovery in<br>> > general?<br>><br>> The former. The AX doesn't react to the ICMP packet too big and<br>> continues sending packets unfragmented.<br>><o:p></o:p></p><p>Any chance you have a bug filed with them and can share the bug Id?<o:p></o:p></p><p>Cb<br>> Best regards,<br>> Daniel<br>><br>> --<br>> CLUE-RIPE -- Jabber: <a href="mailto:dr@cluenet.de">dr@cluenet.de</a> -- dr@IRCnet -- PGP: 0xA85C8AA0<o:p></o:p></p></div></div></div></body></html>