> Source: [sk1000097](https://support.checkpoint.com/results/sk/sk1000097)

# sk1000097 - Large East-West transfers fail when the traffic passes through a Cloud Firewall Network Function on Nutanix AHV (Service Insertion 2.0)

| Property | Value |
|----------|-------|
| Solution ID | sk1000097 |
| Date Created | 2026-09-02 |
| Last Modified | 2026-09-16 |
| Technical Level | Advanced |
| Products | Cloud Firewall |
| Versions | R82.10, R81.20, R82, R82.20 |
| OS | Gaia |
| Platform | Nutanix |

## Symptoms

- These symptoms occur after you enforce a Nutanix Flow security policy that sends East-West traffic to the Network Function:

* File transfers and large downloads stop. The TCP connection is established, and then no more data is transmitted.
* SSH sessions stop at the login prompt.
* HTTPS sessions stop during the TLS handshake.
* Ping operates correctly. DNS operates correctly. Small HTTP responses operate correctly.

In a standard VLAN topology on a physical network with an MTU of 1500 bytes, these test results occur between two secured VMs:

|           Command           | Frame size on the wire |           Result           |
|-----------------------------|------------------------|----------------------------|
| `ping -M do -s 1414 <peer>` | 1442 bytes             | Success                    |
| `ping -M do -s 1415 <peer>` | 1443 bytes             | Failure - 100% packet loss |

Traffic that does not go through the Network Function is not affected. This includes traffic between VMs that the Flow policy does not secure, as well as North-South traffic.

## Cause

Nutanix Flow sends the redirected traffic through a Geneve service-chain overlay. The overlay adds an encapsulation header to each frame, reducing the effective path MTU. On a physical network with an MTU of 1500 bytes and workloads that are attached to VLAN subnets, the effective path MTU decreases to **1442 bytes**.

Additional Flow networking features, such as VPC subnet extension or VPN, add more overhead. For the applicable values, refer to the *Flow Virtual Networking MTUs* table in the [Nutanix Flow Virtual Networking Guide](https://portal.nutanix.com/page/documents/details?targetId=Nutanix-Flow-Virtual-Networking-Guide-v6_0_0:ear-flow-nw-requirements-pc-r.html).

The guest VMs use the default MTU of 1500 bytes. Therefore, they negotiate a TCP MSS of 1460 bytes and transmit full-size segments. The overlay discards each frame that is larger than the effective path MTU, and it does not send an ICMP "fragmentation needed" message, because this is a Layer 2 path. As a result, Path MTU Discovery cannot decrease the segment size.

Smaller packets continue to pass successfully, which can make the problem difficult to identify with basic connectivity tests.

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content