[RHOSP13] Recommendation to disable Path MTU in overcloud nodes

Solution In Progress - Updated -

Environment

  • Red Hat OpenStack Platform 13

Issue

  • "path MTU discovery" could be used by a malicious attacker to receive a reply from the server despite the firewall configuration by forcefully sending a large packet.

Resolution

  • Since Neutron is calculating MTU for the whole path on nodes according to data configured in its database and config files, it's acceptable to disable path MTU in host kernel.

    sysctl -w net.ipv4.ip_no_pmtu_disc=1

This solution is part of Red Hat’s fast-track publication program, providing a huge library of solutions that Red Hat engineers have created while supporting our customers. To give you the knowledge you need the instant it becomes available, these articles may be presented in a raw and unedited form.

Comments