Re: ipfilter NAT + opensolaris zones + amazon ec2

Darren Reed <[email protected]> Wed, 11 Nov 2009 21:55:19 -0800

Newsgroups	gmane.comp.security.firewalls.ipfilter
Message-ID	<5463_1258005435_4AFBA3BB_5463_562_1_4AFBA347.7020003@reed.wattle.id.au>

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
 
David Champion wrote:
| ...
|         ipReasmTimeout      =    15     ipReasmReqds        =     0

I suspect that this line here is the key to the problem.

Using snoop...
- - do you see all of the data/packets arrive on xnf0?
- - do packets go missing between xnf0 and vnic0?
- - do packets go missing between vnic0 and vnic1?

Try changing the mtu of vnic0 and vnic1 down from 9000 to 1500.
To do this, add a new line to hostname.vnic0 and hostname.vnic1 on
each of the respective hosts that is "mtu 1500".

So the hostname.vnic0 file might have two lines:
192.168.0.1
mtu 1500

Cheers,
Darren
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org
 
iEYEARECAAYFAkr7o0cACgkQP7JIXtvLbFV0iACg4AD0F1PAK3iLZW8O7Q/3d3YT
M9oAoJqRSoW66hSPb28PsqHS1y0mOFlW
=SxMx
-----END PGP SIGNATURE-----