08-07-2007 11:35 PM - edited 03-11-2019 03:54 AM
Hi All,
I am a bit confused, we are looking into troubleshooting some issues with MSS and I came across 2 parameters which I am not sure if they both serve the same purpose....
1) sysopt connection tcpmss 1380
According to cisco description, this sets the maximum mss to value of 1380. Does this implies that in a connection from one interface leg of the firewall to another, the MSS value btn two hosts will never "negotiate" above 1380? [in a sense Firewall, intercepts messages and changes TCP MSS value to 1380 during the TCP Handshake?]. Or is this feature only complementary to IPSEC and VPN issues?
2) tcp-excced warning. TCP Exeed warmning occurs if btn a handshake the receiver or the sender transmit data with a value higher or lower than the value mutually agreed during TCP Handshake. Has though this "mutually" agreed value have to do anything with the value of the sysopt? or it "stands" by itself?
08-14-2007 10:08 AM
I think the sysopt connection tcpmss value is only for IPsec and VPN. The tcp-exceed warning has nothing to do with the sysopt connection tcpmss value.
09-01-2007 06:49 AM
Hi All,
The sysopt connection tcpmss value is related to all tcp connection through the pix/asa. Even if they are tunneled through VPN or if they go from local to local LAN PIX/ASA interfaces.
The tcp-exceed, is there to verify that the mss value agreed btn two peers is not violated. So the maximum tcp-exceed value the PIX/ASA will allow is the value of "sysopt connection tcpmss value" + 20 (TCP HDR) + 20 (IP HDR).
If someone is not using any VPN tunneling then it is safe to change the value of tcpmss to 1460 (+20 +20 = 1500).
Regards.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide