1

I am trying to set jumbo MTU for Cisco ASA 5585 and I did following:

asa1/pri/act(config)# mtu inside 9000

INFO: Jumbo frames should be enabled to receive packets more than 1500 MTU
      Use 'jumbo-frame reservation' command to turn on jumbo frame

INFO: TCP MSS may need to be adjusted using 'sysopt connections tcpmss'
      command to pass large TCP segments

Now it is saying you may need to set sysopt connections tcpmss. I have noticed in my old Cisco ASA firewall it has the following setting because when we setup VPN IPsec with AWS they said do following recommended setting:

sysopt connection tcpmss 1379

Question is if I set sysopt connection tcpmss 9000 is it going to break anything in relation to the IPsec tunnel?

  • Are you only enabling jumbo on the inside? – hertitu Mar 25 '18 at 0:13
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Apr 1 '18 at 22:53
2

TCP MSS is just used to notify a sender of the max TCP segment size the receiver can accept. It does not include the TCP or IP headers. So if you set it to the same size as your MTU, by the time you add the relevant headers you can end up with a frame size larger than your MTU. At a minimum, you are creating a scenario where fragmentation has to occur in order to transmit the frame across the link or in the case of a TCP packet with a "Do Not Fragment" bit set, the frame won't be transmitted at all.

2

The MTU is the maximum IP packet size that can be transported on a given network link unfragmented. The IPv4 header and the TCP header (20 bytes each) eat into this packet size - the MSS should always be 40 bytes less than the MTU.

When a TCP segment size causes the packet exceed the link's allowed frame size it causes a high degree of fragmentation which is very inefficient - the router needs to do a lot of work fragmenting and the header overhead is increased, decreasing the usable bandwidth.

  • should i set tcpmss to 9000 - 40 = 8960 ? – Satish Mar 20 '18 at 2:49
  • Anyone knows what to do? – Satish Mar 20 '18 at 21:14
  • 1
    Yes, tcpmss as 8960 with MTU 9000 sounds right. – Zac67 Mar 21 '18 at 17:40
  • what if remote VPN end has only 1500 MTU in that case packet will get fragments right? or there is a way to set tunnel MTU – Satish Mar 21 '18 at 19:22
  • 1
    TCP header is bigger than 20 bytes when it contains options. – hertitu Mar 25 '18 at 0:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.