| Description |
This article describes the behavior of setting TCP-MSS under the config system interface.
Network diagram:
- MTU: stands for ‘Maximum Transmission Unit’ and is the maximum size of an IP packet that can be handled by the layer-3 device.
If the communication network has a lower MTU value, but the client endpoint is not aware of it, it will send its MSS value of 1460 bytes to the server.
The server will therefore think that the client can receive 1500 bytes (1460 MSS+20 IP header+20 TCP header=1500 bytes) and will send a packet with a size of 1500 bytes. If the MTU is lower somewhere in the path, then the packet can be fragmented. If the DF (do not fragment) bit is set then the packet can be dropped, which can cause delays or slowness in the network. |
| Scope | FortiGate. |
| Solution |
Behavior in FortiOS 6.0.x, 6.2.x, 6.4.x and 7.0.0: The change of TCP-MSS is done only in one direction (only for return traffic).
Example 1:
config system interface end
The result will be:
Example 2:
config system interface
The result will be:
Example 3:
config system interface
The result will be:
Behavior in FortiOS from 7.0.1 and 7.2.x: The change of TCP-MSS value is done in both directions.
Example 1:
config system interface end
The result will be:
Example 2:
config system interface
The result will be:
Example 3:
config system interface
The result will be:
Note: If the firewall receives a packet with a segment size that is lower than the one configured on the interface, it will not modify the TCP MSS field. For example, if the interface is configured to set MSS of 1200 and the packet arrives with MSS 1100, the value will not be modified and the packet will be forwarded with MSS 1100.
Related article: |
