tcp-mss setting on IPsec VPN interface do...

FortiGate

FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.

Article Id 378830

Description

This article describes how to handle a situation where, after setting tcp-mss on IPsec VPN interface, it does not work with IPv6 traffic.

Scope

FortiGate v7.2.x.

Solution

In FortiGate, configure IPsec VPN on the FortiGate unit and configure the tcp-mss setting with the following CLI command:

config system interface

edit <IPsec VPN interface’s name>

set tcp-mss 1250

end

Test to ensure that the IPv4 traffic passes. The MSS (Maximum Segment Size) can be limited to 1250.
Test passing the IPv6 traffic. The MSS cannot be limited to 1250: this does not work with IPv6 traffic.

To fix this:

For a workaround with a temporary fix, configure the tcp-mss sender/receiver settings under the firewall policy via the CLI command instead.

config firewall policy

edit <IPsec VPN firewall policy id>

set tcp-mss-sender 1250

set tcp-mss-receiver 1250

end

For a permanent fix, upgrade FortiGate firmware version to v7.2.11 or above.

219

Contributors

Broad. Integrated. Automated.

The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.

Troubleshooting Tip: tcp-mss setting on IPsec VPN interface does not work with IPv6 traffic

You are leaving our website