Many existing DNS clients (resolvers) that support IPv6 first search for AAAA Resource Records (RRs) of a target host name, and then for A RRs of the same name. This fallback mechanism is based on the DNS specifications, which if not obeyed by authoritative servers, can produce unpleasant results. In some cases, for example, a web browser fails to connect to a web server it could otherwise reach. In the following sections, this memo describes some typical cases of such misbehavior and its (bad) effects.<\/em><\/p>\n<\/blockquote>\nA toto je p\u0159\u00edpad NSX-NCP, kde se pou\u017eije eventlet.monkey_patch(), kdy se bude chovat k DNS velmi striktn\u011b. Tud\u00ed\u017e nejprve AAAA a pak A z\u00e1znam.<\/p>\n
\u0158e\u0161en\u00ed jsou 2. Jeden Workaround, kter\u00fd funguje jen do dal\u0161\u00edho update Supervisoru, spo\u010d\u00edv\u00e1 v \u00faprav\u011b specifikace NSX-NCP deploymentu t\u011bsn\u011b pot\u00e9, co se za\u010dnou vytv\u00e1\u0159et v\u0161echny obslu\u017en\u00e9 deploymenty.<\/p>\n
root@423826f144b646d762b12a7399ac0ddd [ ~ ]# kubectl -n vmware-system-nsx get deployment\/nsx-ncp -oyaml\r\napiVersion: apps\/v1\r\nkind: Deployment\r\nmetadata:\r\n annotations:\r\n deployment.kubernetes.io\/revision: \"5\"\r\n kubectl.kubernetes.io\/last-applied-configuration: |\r\n ...\r\n generation: 5\r\n labels:\r\n component: nsx-ncp\r\n tier: nsx-networking\r\n version: v1\r\n name: nsx-ncp\r\n namespace: vmware-system-nsx\r\n resourceVersion: \"9178866\"\r\n uid: e9759f64-754b-4d14-a3b6-91f66029161d\r\nspec:\r\n progressDeadlineSeconds: 600\r\n replicas: 2\r\n revisionHistoryLimit: 10\r\n selector:\r\n matchLabels:\r\n component: nsx-ncp\r\n strategy:\r\n rollingUpdate:\r\n maxSurge: 1\r\n maxUnavailable: 1\r\n type: RollingUpdate\r\n template:\r\n metadata:\r\n annotations:\r\n kubectl.kubernetes.io\/restartedAt: \"2025-12-10T11:30:18Z\"\r\n last-sync: \"1763989124.2055643\"\r\n prometheus.io\/port: \"8001\"\r\n prometheus.io\/scrape: \"true\"\r\n creationTimestamp: null\r\n labels:\r\n component: nsx-ncp\r\n tier: nsx-networking\r\n version: v1\r\n spec:\r\n affinity:\r\n podAntiAffinity:\r\n requiredDuringSchedulingIgnoredDuringExecution:\r\n - labelSelector:\r\n matchExpressions:\r\n - key: component\r\n operator: In\r\n values:\r\n - nsx-ncp\r\n topologyKey: kubernetes.io\/hostname\r\n containers:\r\n - env:\r\n - name: EVENTLET_NO_GREENDNS <===============\r\n value: \"yes\" <===============<\/b>\r\n - name: NCP_NAME\r\n valueFrom:\r\n fieldRef:\r\n apiVersion: v1\r\n fieldPath: metadata.name\r\n - name: NCP_NAMESPACE\r\n valueFrom:\r\n fieldRef:\r\n apiVersion: v1\r\n fieldPath: metadata.namespace \r\n<\/pre>\nDruh\u00e9 \u0159e\u0161en\u00ed by m\u011blo b\u00fdt persistentn\u00ed a to, zajistit aby DNS server nep\u0159epos\u00edlal AAAA z\u00e1znamy mimo. Nastavit jej jako Autoritativn\u00ed <\/strong>pro va\u0161i .local dom\u00e9nu.<\/p>\nMTU<\/h2>\n
P\u0159i simulaci tohoto probl\u00e9mu jsme se pak dostali k druh\u00e9 v\u011bci, kter\u00e1 na prvn\u00ed pohled nebyla v\u016fbec jasn\u00e1.<\/p>\n
Museli jsme vytvo\u0159it nov\u00e9 prost\u0159ed\u00ed, ve kter\u00e9m bychom mohli celou situaci nasimulovat. Kdy\u017e jsem to zkou\u0161el u sebe, tak se mi to neda\u0159ilo, ale nem\u011bl jsem tam \u00fapln\u011b v\u0161echny prvky k dispozici. Zejm\u00e9na Fortigate, kter\u00fd obsluhoval DNS. Tak jsme se rozhodli ke kroku, vytvo\u0159it Nested prost\u0159ed\u00ed nad st\u00e1vaj\u00edc\u00edm clusterem, abychom nemuseli sh\u00e1n\u011bt dal\u0161\u00ed 4 ESX hosty. Ve verzi 8 toti\u017e Supervisor vy\u017eaduje 3 Control Plane VM, tzn. bez 4 host\u016f v clusteru V\u00e1s nepust\u00ed pr\u016fvodce d\u00e1l.<\/p>\n
Hosty vytvo\u0159eny, p\u0159ipojeny do vCenter, NSX nakonfigurov\u00e1n. Jakmile jsme ale cht\u011bli ud\u011blat testovac\u00ed VM, kter\u00e1 bude komunikovat s vCenter, tak jsme narazili na probl\u00e9m. ICMP pro\u0161lo, curl na HTTP pro\u0161lo – p\u0159i\u0161la odpov\u011b\u010f. Ale jakmile jsme se pokou\u0161eli nav\u00e1zat HTTPS spojen\u00ed, tak to kon\u010dilo ne\u00fasp\u011bchem. S jinou VM, ve stejn\u00e9 s\u00edti, ale mimo Nested prost\u0159ed\u00ed v\u0161e fungovalo.<\/p>\n
Dlouho jsem si l\u00e1mal hlavu, v \u010dem je to prost\u0159ed\u00ed jin\u00e9. Bylo to nested, ale t\u011bch jsem vytvo\u0159il za celou svou dobu s VMware spoustu a nikdy jsem se s t\u00edmto probl\u00e9mem nesetkal. P\u0159em\u00fd\u0161lel jsem i nad omezen\u00fdmi instruk\u010dn\u00edmi sadami nov\u00fdch procesor\u016f a porovn\u00e1val, co VM dost\u00e1vaj\u00ed v jin\u00fdch ESX hostech.<\/p>\n
Jak nadpis napov\u00edd\u00e1, probl\u00e9m byl v MTU. Kdy Nested hosty byly p\u0159ipojen\u00e9 do jin\u00e9 Overlay VLAN a MTU routeru mezi segmenty zapomn\u011blo b\u00fdt zm\u011bn\u011bno a z\u016fstalo na 1500.<\/p>\n
Jak se to projevovalo jsem zaznamenal p\u0159i zachyt\u00e1v\u00e1n\u00ed packet\u016f<\/p>\n
12:14:06.524329 IP 192.168.250.11.59648 > vcenter.mojedomena.local.https: Flags [S], seq 2119065766, win 64240, options [mss 1460<\/b>,sackOK,TS val 3900574725 ecr 0,nop,wscale 7], length 0\r\n12:14:06.525493 IP vcenter.mojedomena.local.https > 192.168.250.11.59648: Flags [S.], seq 3546398388, ack 2119065767, win 28960, options [mss 1460,sackOK,TS val 1399004370 ecr 3900574725,nop,wscale 8], length 0\r\n12:14:06.525602 IP 192.168.250.11.59648 > vcenter.mojedomena.local.https: Flags [.], ack 1, win 502, options [nop,nop,TS val 3900574727 ecr 1399004370], length 0\r\n12:14:06.528653 IP 192.168.250.11.59648 > vcenter.mojedomena.local.https: Flags [P.], seq 1:518, ack 1, win 502, options [nop,nop,TS val 3900574729 ecr 1399004370], length 517\r\n12:14:06.529641 IP vcenter.mojedomena.local.https > 192.168.250.11.59648: Flags [.], ack 518, win 118, options [nop,nop,TS val 1399004374 ecr 3900574729], length 0\r\n12:14:06.543649 IP vcenter.mojedomena.local.https > 192.168.250.11.59648: Flags [P.], seq 1449:1889, ack 518, win 118, options [nop,nop,TS val 1399004388 ecr 3900574729], length 440\r\n12:14:06.543780 IP 192.168.250.11.59648 > vcenter.mojedomena.local.https: Flags [.], ack 1, win 502, options [nop,nop,TS val 3900574745 ecr 1399004374,nop,nop,sack 1 {1449:1889}], length 0\r\n12:14:38.379354 IP 192.168.250.11.59648 > vcenter.mojedomena.local.https: Flags [F.], seq 518, ack 1, win 502, options [nop,nop,TS val 3900606580 ecr 1399004374,nop,nop,sack 1 {1449:1889}], length 0\r\n12:14:38.380200 IP vcenter.mojedomena.local.https > 192.168.250.11.59648: Flags [F.], seq 1889, ack 519, win 118, options [nop,nop,TS val 1399036224 ecr 3900606580], length 0\r\n12:14:38.380357 IP 192.168.250.11.59648 > vcenter.mojedomena.local.https: Flags [R], seq 2119066285, win 0, length 0<\/pre>\nD\u016fvod jsem zv\u00fdraznil a je hned v prvn\u00ed \u0159\u00e1dku. P\u0159i sestavov\u00e1n\u00ed TCP session klient na za\u010d\u00e1tku ozn\u00e1m\u00ed, jak\u00e9 MTU m\u016f\u017ee pos\u00edlat a p\u0159ij\u00edmat. Toto provede jen na z\u00e1klad\u011b nastaven\u00ed na s\u00ed\u0165ov\u00e9 kart\u011b\/OS. Bez kontroly po cest\u011b.<\/p>\n
Jakto, \u017ee ICMP a HTTP pro\u0161lo a probl\u00e9m byl a\u017e s HTTPS?<\/p>\n
ICMP a HTTP pos\u00edlaj\u00ed relativn\u011b mal\u00e9 pakety, kter\u00e9 se do 1400B okna vejdou bez probl\u00e9m\u016f – nezkou\u0161el jsem p\u0159ij\u00edmat obr\u00e1zky, tam by se to asi projevilo, ale testujte obr\u00e1zek z CLI \ud83d\ude42<\/p>\n
HTTPS chce hned na za\u010d\u00e1tku komunikace pos\u00edlat Certifik\u00e1t a ten se u\u017e rozd\u011bl\u00ed do velikosti 1460 B jak je na za\u010d\u00e1tku TCP sync, ale kdy\u017e se do toho zakomponuje Geneve, kter\u00fd m\u00e1 s\u00e1m o sob\u011b minim\u00e1ln\u011b 54B re\u017eii, tak se dost\u00e1v\u00e1me mimo 1500 MTU nastaven\u00e9 na routeru a ten to zahazoval.<\/p>\n
Tak\u017ee kontrola ICMP paketu 1600+ v\u0161e prozradila, p\u0159enastaveno na jumbo 9126 a voila, v\u0161e za\u010dalo fungovat.<\/p>\n
Tak\u017ee Always DNS a kontrolujte si MTU. Opravdu na tom z\u00e1le\u017e\u00ed a nen\u00ed to jen n\u011bco, co si s\u00ed\u0165a\u0159i vym\u00fd\u0161l\u00ed.<\/p>\n
<\/p>","protected":false},"excerpt":{"rendered":"
Ned\u00e1vno jsem u jednoho z\u00e1kazn\u00edka \u0159e\u0161il nasazen\u00ed Supervisor clusteru. Celkem trivi\u00e1ln\u00ed v\u011bc, \u0159eknete se si, ale narazili jsme na n\u011bkolik v\u011bc\u00ed, kter\u00e9 zat\u00edm nebyly pln\u011b<\/p>\n
Continue ReadingPro\u010d na DNS a MTU skute\u010dn\u011b z\u00e1le\u017e\u00ed – Supervisor Story<\/span> <\/i><\/a><\/div>","protected":false},"author":4,"featured_media":1895,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"iawp_total_views":88,"footnotes":""},"categories":[51,50,64,3],"tags":[87,43,52,88,59,11,7,9],"class_list":["post-1888","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-k8s","category-nsx","category-vcf","category-vsphere","tag-dns","tag-failed","tag-k8s","tag-mtu","tag-nsx","tag-troubleshooting","tag-vcenter","tag-vsphere","entry"],"_links":{"self":[{"href":"https:\/\/virtualguru.cz\/en\/wp-json\/wp\/v2\/posts\/1888","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/virtualguru.cz\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/virtualguru.cz\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/virtualguru.cz\/en\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/virtualguru.cz\/en\/wp-json\/wp\/v2\/comments?post=1888"}],"version-history":[{"count":6,"href":"https:\/\/virtualguru.cz\/en\/wp-json\/wp\/v2\/posts\/1888\/revisions"}],"predecessor-version":[{"id":1897,"href":"https:\/\/virtualguru.cz\/en\/wp-json\/wp\/v2\/posts\/1888\/revisions\/1897"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/virtualguru.cz\/en\/wp-json\/wp\/v2\/media\/1895"}],"wp:attachment":[{"href":"https:\/\/virtualguru.cz\/en\/wp-json\/wp\/v2\/media?parent=1888"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/virtualguru.cz\/en\/wp-json\/wp\/v2\/categories?post=1888"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/virtualguru.cz\/en\/wp-json\/wp\/v2\/tags?post=1888"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"\"](\"https:\/\/virtualguru.cz\/wp-content\/uploads\/2026\/01\/Vguru-Image-235-1-300x129.png\")
<\/a> ![\"\"](\"https:\/\/virtualguru.cz\/wp-content\/uploads\/2026\/01\/Vguru-Image-236-300x147.png\")
<\/a><\/p>\n![\"\"](\"https:\/\/virtualguru.cz\/wp-content\/uploads\/2026\/01\/Vguru-Image-235-1.png\")
<\/a> ![\"\"](\"https:\/\/virtualguru.cz\/wp-content\/uploads\/2026\/01\/Vguru-Image-236.png\")
<\/a><\/p>\n