interconnect/WARN/2026_002

Product: Cloud Interconnect, Cloud VPN, VPC Rule class: WARN - Something that is possibly wrong.

Description

This rule checks for potential packet loss in hybrid connectivity setups (Cloud Interconnect or Cloud VPN) due to Maximum Transmission Unit (MTU) issues.

The rule verifies:

1. Packet Drops (Metrics): Checks Cloud Monitoring for the last 7 days for:
   • Non-zero egress_dropped_packets_count or ingress_dropped_packets_count on Interconnect attachments with the reason EXCEEDS_MTU.
   • Non-zero sent_packets_count on Cloud VPN gateways with the status exceeds_mtu.
2. Configuration Mismatch: Ensures the MTU of Cloud Interconnect VLAN attachments matches the MTU of the associated VPC network.

Mismatched MTUs or blocked Path MTU Discovery (PMTUD) can lead to silent packet drops, impacting application performance and reliability, particularly for UDP traffic or in asymmetric routing scenarios.

Remediation

1. Identify the Affected Resource: The rule output will specify the VLAN attachment, VPN gateway, or project.
2. Check MTU Settings: Verify MTU consistency across the entire network path:
   • VPC Network: Check VPC MTU.
   • VLAN Attachment: Check Interconnect MTU. Must match the VPC MTU.
   • Cloud VPN: While the gateway MTU is fixed, ensure on-premises and GCP VM MTUs account for VPN encapsulation overhead. Review Cloud VPN MTU Considerations.
   • VMs: Check VM MTU settings.
   • On-premises Network: Investigate MTU settings on the on-premises routers, firewalls, and hosts.
3. Ensure Path MTU Discovery (PMTUD):
   • Verify that firewall rules (both in GCP and on-premises) allow necessary ICMP messages for PMTUD to function. Specifically, ICMP Type 3, Code 4 (“Destination Unreachable - Fragmentation Needed and Don’t Fragment was Set”) is crucial.
4. Align MTUs: Adjust MTU settings to the lowest common value across the path if PMTUD cannot be reliably enabled. This might involve changes to VPC, VLAN attachments (requires recreation), VMs, or the on-premises devices.

Note: This gcpdiag rule detects symptoms and configuration mismatches but cannot verify firewall configurations regarding ICMP for PMTUD.

Further Information

• VPC - Maximum Transmission Unit
• Cloud Interconnect - MTU
• Cloud VPN - MTU Considerations