Technical Note: How to avoid MSS mismatch

[cramirez]

Description

In order to solve MSS (Maximum Segment Size) mismatch, the size of the MSS can be changed on the policies of the FortiGate.

Solution

Based on the previous diagram:

1. If the issue occurs when a user on internal tries to visit a site on “web server”

2. On policy from “internal” to “internet”

configure firewall policy
edit x
set tcp-mss-sender 1300
end

3. Clear all sessions with these IP addresses.