cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
315
Views
0
Helpful
6
Replies

Web access to switch in DMZ issue

bob.bartlett
Level 1
Level 1

when we try to connect to the web interface we get this in the logs Dropping TCP packet from dmz:smswitch.internal/80 to outside:cox.home/50206, reason: MSS exceeded, MSS 1260, data 1430

6 Replies 6

JORGE RODRIGUEZ
Level 10
Level 10

Are you running 7.x? there seems to be workaround.. check this link.

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a00804c8b9f.shtml

Rgds

Jorge

Jorge Rodriguez

Running 8.03 and tried that no joy.

Running 8.03

Robert, did you follow the example in the link using service-policy to activate the policy map created and apply it on outside interface? and using the keyword exceed-mss allow ?

I did some other search and found this is the only way to make this work even on version 8.0 as this is only done through policy framework class-map etc..

also on your original post you indicated this only happens on only a particular weblink , lookin at the log cox.home ? do you know the actual link dns name?

Jorge Rodriguez

try this script and add it to your global policy, replace server_ip with the destination dmz host ip address.

access-list http-list permit tcp any host server_ip eq 80

class-map http

match access-list http-list

tcp-map tmap

exceed-mss allow

policy-map global_policy

class http

set connection advanced-options tmap

Rgds

Jorge

Jorge Rodriguez

I did that previously and it didn't work. As for the DNS it is a switch and the switch does not have a dns entry. We access it by IP.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Review Cisco Networking products for a $25 gift card