[76992] in North American Network Operators' Group
Re: Broken PMTUD for . + TLD servers, was: Re: Smallest Transit MTU
daemon@ATHENA.MIT.EDU (Mark Andrews)
Mon Jan 10 08:44:14 2005
To: Suresh Ramasubramanian <ops.lists@gmail.com>
Cc: Alexei Roudnev <alex@relcom.net>, nanog@merit.edu
From: Mark Andrews <Mark_Andrews@isc.org>
In-reply-to: Your message of "Mon, 10 Jan 2005 18:59:25 +0530."
<bb0e440a050110052975b02a4@mail.gmail.com>
Date: Tue, 11 Jan 2005 00:43:43 +1100
Errors-To: owner-nanog-outgoing@merit.edu
> On Mon, 10 Jan 2005 22:42:28 +1100, Mark Andrews <Mark_Andrews@isc.org> wrote
> :
> > > I receive DNS responses > 500 bytes every day (reported by PIX firewall).
> So
> > > it is an issue, no matter wgat is recomended in RFC.
> >
> > The correct thing to do is to fix your firewall to handle the
> > EDNS responses.
>
> It is a cisco pix, right? Maybe just replacing the thing with a 1U
> openbsd box will work wonders.
A PIX firewall can handle EDNS fine. It just has to be told
what is the maximum EDNS size being advertised by the internal
clients. The defaults assume there is no EDNS (e.g. 512).
--
Mark Andrews, ISC
1 Seymour St., Dundas Valley, NSW 2117, Australia
PHONE: +61 2 9871 4742 INTERNET: Mark_Andrews@isc.org
