Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor III

Fortigates with PPPoE WAN suddenly need TCP MSS 1452 on INSIDE to access HTTPS

Reports started rolling in on Monday, 22 April 2024, at approximately 07:00 AWST (Sunday, 21 April 2024, 23:00 UTC) that people could not access HTTPS websites but could access HTTP websites.

We found that the common denominator was that only customers with a PPPoE dialler for the WAN/Internet service were impacted.

We've seen this in the past and resolved it by adding "set tcp-mss 1452" to the LAN/INSIDE interface/s configuration of our Fortigates.

We provide Internet to many of the customers, but not all - it does not seem to be isolated to a specific network or ISP.
I wasn't involved in the initial information gathering, so I'm unsure if it was limited to specific sites, but I was aware that sites such as (all of Microsoft),, and were impacted.

The question is, why is it only impacting Fortigates (we have customers with different firewall vendors who didn't have the same issue), & why were they working fine before when the reports came in?

We had done no firmware updates to any of the units, nothing was changed from our side.
Most (if not all) units have automatic Fortiguard updates.



1 Solution
New Contributor III

Looks like this has happened due to a default setting change in Chrome (and Edge is a derivative of Chrome) changing “TLS 1.3 Hybridized Kyber Support” from disabled to enabled which apparently adds extra data in the client hello message:

Chrome 124 was released April 16th (not all machines would have immediately pulled down the update) so this lines up with the timeline of when issues have cropped up at various customer sites sites. Lowering TCP MSS has worked around this issue by allowing packets with extra data in them to go through without packet defragmentation happening. There are many threads recently about this: (Sonic Wall)

It (TLS 1.3 Hybridized Kyber support) has been known for a while as an issue with Fortigates but only now has the defaults changed in Chrome:

With regards to Edge: "Also downgrading to 123.X.X versions works" according to:

Edge 124 was released 18-Apr-2024.

View solution in original post

New Contributor II

Exactly same issue around here, thank you for posting and making the problem more visible. Might help people in the same situation.


Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Top Kudoed Authors