Disable TCP checksum offloading

This document (000021359) is provided subject to the disclaimer at the end of this document.

Environment

SUSE Rancher
RKE1, RKE2, k3s
Calico CNI
Cilium CNI
VMware VSphere
VMware NSX

Situation

Modern networking cards have multiple features that help the operating system by performing various tasks such as generating and checking checksums, splitting packets, and classifying them.

You may be using one of the mentioned CNIs (Container Network Interfaces), a VMware on-premise provider to run your computing infrastructure, or on the cloud using a VMware NSX device. It is not necessary to run all the mentioned components at the same time. You can have issues by using just one of them or a combination of them.

Resolution

To disable the tx-checksum-ip-generic offloading feature on a Linux host, you can use ethtool.

/usr/sbin/ethtool -K <vxlan-interface-name> tx-checksum-ip-generic off

This change will not persist after an OS reboot, so there are various methods to achieve this. The procedure may vary depending on the Networking Manager you are using. This is a specific example from SUSE Linux Enterprise Server, which can be applied to any of the SP releases and the Canal CNI provider.

cat > /etc/systemd/system/ethtool-patch-flannel.1-checksum.service

[Unit]
Description=Turn off checkdum on flannel.1
After=sys-subsystem-net-devices-flannel.1.device
[Install]
WantedBy=sys-subsystem-net-devices-flannel.1.device
[Service]
Type=oneshot
ExecStart=/usr/sbin/ethtool -K flannel.1 tx-checksum-ip-generic off

Start service

/usr/bin/systemctl enable ethtool-patch-flannel.1-checksum.service 
/usr/bin/systemctl start ethtool-patch-flannel.1-checksum.service

Cause

When using VXLAN overlay networks, modern recent versions of Linux enable VXLAN hardware offloading by default. However, a problem can occur when inner packets flow through the networking stack with incorrect checksums due to a miscalculation in the hardware offloading mechanism. This can cause Linux to drop these packets and create networking connectivity issues.

Additional Information

https://github.com/flannel-io/flannel/issues/1279

https://github.com/kubernetes/kops/pull/9074

Disclaimer

This Support Knowledgebase provides a valuable tool for SUSE customers and parties interested in our products and solutions to acquire information, ideas and learn from one another. Materials are provided for informational, personal or non-commercial use within your organization and are presented "AS IS" WITHOUT WARRANTY OF ANY KIND.