I am a bit confused, we are looking into troubleshooting some issues with MSS and I came across 2 parameters which I am not sure if they both serve the same purpose....
1) sysopt connection tcpmss 1380
According to cisco description, this sets the maximum mss to value of 1380. Does this implies that in a connection from one interface leg of the firewall to another, the MSS value btn two hosts will never "negotiate" above 1380? [in a sense Firewall, intercepts messages and changes TCP MSS value to 1380 during the TCP Handshake?]. Or is this feature only complementary to IPSEC and VPN issues?
2) tcp-excced warning. TCP Exeed warmning occurs if btn a handshake the receiver or the sender transmit data with a value higher or lower than the value mutually agreed during TCP Handshake. Has though this "mutually" agreed value have to do anything with the value of the sysopt? or it "stands" by itself?
The sysopt connection tcpmss value is related to all tcp connection through the pix/asa. Even if they are tunneled through VPN or if they go from local to local LAN PIX/ASA interfaces.
The tcp-exceed, is there to verify that the mss value agreed btn two peers is not violated. So the maximum tcp-exceed value the PIX/ASA will allow is the value of "sysopt connection tcpmss value" + 20 (TCP HDR) + 20 (IP HDR).
If someone is not using any VPN tunneling then it is safe to change the value of tcpmss to 1460 (+20 +20 = 1500).
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
Table of Contents Introduction:This document describes details on how
NAT-T works. Background: ESP encrypts all critical information,
encapsulating the entire inner TCP/UDP datagram within an ESP header.
ESP is an IP protocol in the same sense that TCP an...