I am trying to set jumbo MTU for Cisco ASA 5585 and I did following:

asa1/pri/act(config)# mtu inside 9000

INFO: Jumbo frames should be enabled to receive packets more than 1500 MTU
      Use 'jumbo-frame reservation' command to turn on jumbo frame

INFO: TCP MSS may need to be adjusted using 'sysopt connections tcpmss'
      command to pass large TCP segments

Now it is saying you may need to set sysopt connections tcpmss. I have noticed in my old Cisco ASA firewall it has the following setting because when we setup VPN IPsec with AWS they said do following recommended setting:

sysopt connection tcpmss 1379

Question is if I set sysopt connection tcpmss 9000 is it going to break anything in relation to the IPsec tunnel?

  • Are you only enabling jumbo on the inside?
    – hertitu
    Mar 25, 2018 at 0:13
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Apr 1, 2018 at 22:53

2 Answers 2


TCP MSS is just used to notify a sender of the max TCP segment size the receiver can accept. It does not include the TCP or IP headers. So if you set it to the same size as your MTU, by the time you add the relevant headers you can end up with a frame size larger than your MTU. At a minimum, you are creating a scenario where fragmentation has to occur in order to transmit the frame across the link or in the case of a TCP packet with a "Do Not Fragment" bit set, the frame won't be transmitted at all.


The MTU is the maximum IP packet size that can be transported on a given network link unfragmented. The IPv4 header and the TCP header (20 bytes each) eat into this packet size - the MSS should always be 40 bytes less than the MTU.

When a TCP segment size causes the packet exceed the link's allowed frame size it causes a high degree of fragmentation which is very inefficient - the router needs to do a lot of work fragmenting and the header overhead is increased, decreasing the usable bandwidth.

  • should i set tcpmss to 9000 - 40 = 8960 ?
    – Satish
    Mar 20, 2018 at 2:49
  • Anyone knows what to do?
    – Satish
    Mar 20, 2018 at 21:14
  • 1
    Yes, tcpmss as 8960 with MTU 9000 sounds right.
    – Zac67
    Mar 21, 2018 at 17:40
  • what if remote VPN end has only 1500 MTU in that case packet will get fragments right? or there is a way to set tunnel MTU
    – Satish
    Mar 21, 2018 at 19:22
  • 1
    TCP header is bigger than 20 bytes when it contains options.
    – hertitu
    Mar 25, 2018 at 0:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.