SW1 is newly introduced switch and after insertion, SSH from the MX to any of the swithces fails but ping works. interface at the MX side is in routing-instance VRF. so ping with 1472 payload and -df set was working well but SSH fails. SSH to the same swtiches from other devices behind the MX works!. we fixed the MTU to 9100 everywhere and SSH from the MX to the SWs works. was just curious, why does SSH fail even though 1472 payload goes through without fragmentation.
its only SSH originating from the MX to any of the switches that fails.
The primary reason is : "The SSH response packets have the DF bit set by default ;So SW1 might be dropping the packets on the interface conneting to MX. "
It is always recommended to have the same MTU on both ends of point to point link. So if you match MUT between MX and SW1 either by reducing the MX MTU or by increasing the SW1 MTU you should not see the problem.
This seems to be a expected behaviour !!
Hope this helps !!
Please accept this as a solution if it answers your question so others can benefit from your post.
Accept as Solution = cool ! Accept as Solution+Kudo = You are a Star !
My understanding is, fragmentation happens on egress, not ingress. When MX and SW negociate the TCP MSS, it will be a higher value compare to the MX facing interface of SW1. Hence SSH packet will be dropped on the ingress of SW1 when initiating SSH from MX side. if you change the MTU of SW2 facing interface to 1514 and change the MTU of MX facing interface to 9100, I believe you will see SSH failure when initiate from SW2.
As mentioned by Arpit, we already recommand the same MTU value along the path.