Enable Jumbo Frames on Ubiquiti Unifi Security Gateway (USG)

Everyone who owns an Unifi product is familiar with SDN controller, the UI and how to configure it. When you need Jumbo Frames or MTU sizes above the default of 1500 you need to adjust your configuration. On the Unifi Switches this can easily be done from the controller UI itself.  As you can see in the screenshot below (from my own Unifi SDN Controller), you only have to do one-click in order to enable it on the switch. This can be done on all the switches.


jumbo_frames

However, when you do this, it only enables jumbo frames on the same layer-2 segment. When we need jumbo frames across a layer-3 interface (Router), in this case, the USG, we need to enable a higher MTU size than 1500 on the specific interfaces.

Since there is no possibility in the UI we need to do this via the CLI. Login via SSH onto your USG and execute the following commands:

admin@USG# set interfaces ethernet eth1 mtu 9000
admin@USG# set interfaces ethernet eth1 vif 12 mtu 9000
admin@USG# set interfaces ethernet eth1 vif 13 mtu 9000

In my case, I enabled Jumbo Frames on the physical eth1 interface (LAN1) and the VLAN interfaces 12 and 13. Since I have a controller-based setup, the CLI input is not persistent. We need to convert these commands into json file configuration for the SDN controller. Refer to this blog post, to see how to do this.

My json configuration for the interfaces looks like this:

{
“interfaces”: {
“ethernet”: {
“eth1”: {
“mtu”: “9000”,
“speed”: “auto”,
“vif”: {
“12”: {
“address”: [
“192.168.12.254/24”
],
“firewall”: {
“in”: {
“ipv6-name”: “LANv6_IN”,
“name”: “LAN_IN”
},
“local”: {
“ipv6-name”: “LANv6_LOCAL”,
“name”: “LAN_LOCAL”
},
“out”: {
“ipv6-name”: “LANv6_OUT”,
“name”: “LAN_OUT”
}
},
“mtu”: “9000”
}
},
“13”: {
“address”: [
“192.168.13.254/24”
],
“firewall”: {
“in”: {
“ipv6-name”: “LANv6_IN”,
“name”: “LAN_IN”
},
“local”: {
“ipv6-name”: “LANv6_LOCAL”,
“name”: “LAN_LOCAL”
},
“out”: {
“ipv6-name”: “LANv6_OUT”,
“name”: “LAN_OUT”
}
},
“mtu”: “9000”
}
},

After I saved the configuration to my Unifi controller I was able to push the configuration successfully. I now have an Jumbo Frames enabled USG setup.

Thanks for reading, if you have any questions or remarks, please don’t hesitate to reach out!

Cheers!
-Wesley-

6 comments

  1. I’m trying to get this to work, when I update the config.gateway.json file I get the error below:

    configuration commit error. Error message: {“DELETE”:{“failure”:”0″,”success”:”1″},”SESSION_ID”:”8be99e781cd096ef2de08b32d1″,”SET”:{“error”:{“interfaces ethernet eth0 vif 100 mtu 9000″:”MTU must be least than or equal to parent interface MTU\n\nValue validation failed\n”,”interfaces ethernet eth0 vif 200 mtu 9000″:”MTU must be least than or equal to parent interface MTU\n\nValue validation failed\n”,”interfaces ethernet eth0 vif 99 mtu 9000″:”MTU must be least than or equal to parent interface MTU\n\nValue validation failed\n”},”failure”:”1″,”success”:”1″}}

    Like

      1. Yes on the PC i”m using it is. Do you mean on the USG itself? The switch has the jumbo frames enabled. Thanks for the quick reply!

        Like

      2. Yes I do. Here is the text of my json file. I actually copied it from the config.boot file. Thanks for the help!!!

        “interfaces”: {
        “ethernet”: {
        “eth0”: {
        “address”: [
        “192.168.10.1/24”
        ],
        “description”: “LAN”,
        “duplex”: “auto”,
        “firewall”: {
        “in”: {
        “ipv6-name”: “LANv6_IN”,
        “name”: “LAN_IN”
        },
        “local”: {
        “ipv6-name”: “LANv6_LOCAL”,
        “name”: “LAN_LOCAL”
        },
        “out”: {
        “ipv6-name”: “LANv6_OUT”,
        “name”: “LAN_OUT”
        }
        },
        “mtu”: “9000”,
        “speed”: “auto”,
        “vif”: {
        “100”: {
        “address”: [
        “192.168.100.1/24”
        ],
        “firewall”: {
        “in”: {
        “ipv6-name”: “LANv6_IN”,
        “name”: “LAN_IN”
        },
        “local”: {
        “ipv6-name”: “LANv6_LOCAL”,
        “name”: “LAN_LOCAL”
        },
        “out”: {
        “ipv6-name”: “LANv6_OUT”,
        “name”: “LAN_OUT”
        }
        },
        “mtu”: “9000”
        },
        “200”: {
        “address”: [
        “192.168.200.1/24”
        ],
        “firewall”: {
        “in”: {
        “ipv6-name”: “LANv6_IN”,
        “name”: “LAN_IN”
        },
        “local”: {
        “ipv6-name”: “LANv6_LOCAL”,
        “name”: “LAN_LOCAL”
        },
        “out”: {
        “ipv6-name”: “LANv6_OUT”,
        “name”: “LAN_OUT”
        }
        },
        “mtu”: “9000”
        },
        “99”: {
        “address”: [
        “172.16.0.1/24”
        ],
        “firewall”: {
        “in”: {
        “ipv6-name”: “GUESTv6_IN”,
        “name”: “GUEST_IN”
        },
        “local”: {
        “ipv6-name”: “GUESTv6_LOCAL”,
        “name”: “GUEST_LOCAL”
        },
        “out”: {
        “ipv6-name”: “GUESTv6_OUT”,
        “name”: “GUEST_OUT”
        }
        },
        “mtu”: “9000”
        }
        }
        },
        “eth1”: {
        “disable”: “””,
        “duplex”: “auto”,
        “speed”: “auto”
        },
        “eth2”: {
        “address”: [
        “dhcp”
        ],
        “description”: “WAN”,
        “dhcp-options”: {
        “client-option”: [
        “retry 60;”
        ],
        “default-route”: “update”,
        “default-route-distance”: “1”,
        “name-server”: “no-update”
        },
        “duplex”: “auto”,
        “firewall”: {
        “in”: {
        “ipv6-name”: “WANv6_IN”,
        “name”: “WAN_IN”
        },
        “local”: {
        “ipv6-name”: “WANv6_LOCAL”,
        “name”: “WAN_LOCAL”
        },
        “out”: {
        “ipv6-name”: “WANv6_OUT”,
        “name”: “WAN_OUT”
        }
        },
        “speed”: “auto”
        },
        “eth3”: {
        “disable”: “””,
        “duplex”: “auto”,
        “speed”: “auto”
        }
        },
        “loopback”: {
        “lo”: “””
        }
        }

        Like

      3. It should work when you only edit the ‘parent interface’ with the 9000 MTU as well. The VIF interfaces will automatically get the MTU of 9000, even when you don’t specifically configure it on the USG.

        Like

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s