topic Re: PIX 6.3 IPSec tunnels and MSS in Network Security

PIX 6.3 IPSec tunnels and MSS

pruhnke79 — Fri, 21 Feb 2020 08:40:18 GMT

I have been looking to see if PIX 6.3 has the same capabilites as listed in the following link.

http://www.cisco.com/en/US/customer/tech/tk827/tk369/technologies_white_paper09186a00800d6979.shtml

Basically we deploy IPSec tunnels to various clients, on the routers we have found it is very effective to implment the following on our routers to account for the additional headers added by a tunnel...

interface Tunnel0

ip tcp adjust-mss 1370

This uses TCP to adjust the host MTU so I don't have worry about packets being fragmented to pass through the tunnel.

I was wondering if anyone know if there is an equilivant command on a PIX running 6.3 to do the same or if the perform this type of correction by defualt. I am only able to find this on the routers, nothing either way on the PIX.

Thanks!

Re: PIX 6.3 IPSec tunnels and MSS

mchin345 — Tue, 31 Jan 2006 17:37:05 GMT

To my knowledge , FragGuard and virtual reassembly is a feature that provides IP fragment protection. This feature performs full reassembly of all ICMP error messages and virtual reassembly of the remaining IP fragments that are routed through the PIX Firewall. Virtual reassembly is currently enabled by default. This feature uses syslog to log any fragment overlapping and small fragment offset anomalies, especially those caused by a teardrop attack.

http://www.cisco.com/en/US/products/sw/secursw/ps2120/products_configuration_guide_chapter09186a0080172790.html

Re: PIX 6.3 IPSec tunnels and MSS

aacole — Mon, 13 Feb 2006 20:37:22 GMT

There is a sysopt command on the PIX that does this, its set to 1460 by default I think. Do `sh sysopt' all the options are listed there.

Andy

Re: PIX 6.3 IPSec tunnels and MSS

jkarpenk — Sun, 19 Feb 2006 07:17:35 GMT

you probably already found this, but to add my $0.02 to the table. the command is "sysopt connection tcpmss 1370", and the default MSS value for the PIX is 1380. i've only seen this useful in PPPoX VPN issues, unless there is an intermediate link MTU that could also be causing your problem. you might also looking into using "transport" mode in place of "tunnel" mode (default) in your ipsec configs.

/karpenko/

Re: PIX 6.3 IPSec tunnels and MSS

scottvivian — Thu, 02 Mar 2006 14:49:53 GMT

sysopt connection tcpmss

The default is 1380.

Good luck - Scott

Re: PIX 6.3 IPSec tunnels and MSS

glenthms — Sat, 11 Mar 2006 14:57:11 GMT

Hey thanks for helping us out.

Signed,

Goatboy

Re: PIX 6.3 IPSec tunnels and MSS

hegderakesh — Fri, 17 Mar 2006 20:14:31 GMT

Hi,

You can use sysopt connection tcpmss command.

Please rate if you find this useful

-Rakesh