topic sysopt connection tcpmss and MTU of 9216 in Network Security

sysopt connection tcpmss and MTU of 9216

patoberli — Mon, 11 Mar 2019 23:04:17 GMT

Hi All

We have a new ASA5585 as an internal firewall that will slowly replace our aging FWSM. For optimum performance it was adviced on the FWSM to set sysopt connection tcpmss to 0, even though using MTU of 1500.

On the new ASA are we now going to enable MTU of 9216 for the contexts. The ASA is running in transparent multicontext mode.

I read this here: http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a0080ba9521.shtml which advises against setting the tcpmss to 0. But if I understand it correct, that means that the MTU of 9216 is useless, right?

So in our case it would be needed to turn of the tcpmss feature to actually use the higher MTU?

Thanks

Pato

sysopt connection tcpmss and MTU of 9216

Marcin Latosiewicz — Wed, 09 May 2012 15:57:28 GMT

Pato,

Jumbo frames support:

http://www.cisco.com/en/US/docs/security/asa/asa84/command/reference/jk.html#wp1633967

having a look at internal documentation we suggest setting MSS to 9096 (120 bytes lower tahn MTU) while typically we would set it to 40 bytes lower.

Now what you need to remember that we will use lower of the two MSSes advertised by peers.

sysopt connection tcpmss and MTU of 9216

patoberli — Wed, 09 May 2012 16:16:35 GMT

Thanks for the clarification!

sysopt connection tcpmss and MTU of 9216

ROBERTO TACCON — Wed, 09 May 2012 18:26:00 GMT

Hello Marcin,

please can you clarify the following questions:

if I enable Jumbo frames support on an interface it is necessary to enable it on all the interfaces ?

if I have a cluster A/S and I enable the Jumbo frames support is it necessary to configure also the "Stateful Failover"

interface ?

as the "sysopt connection tcpmss 9096" is a global system configuration is it possible to configure only 2 interfaces with mtu 9216 and leave all other interfaces to the default 1500 ?

Best Regards

Roberto Taccon

sysopt connection tcpmss and MTU of 9216

Marcin Latosiewicz — Wed, 09 May 2012 19:22:36 GMT

Roberto.

My knowledge about this feature is from several years ago, feel free to doublecheck.

Enabling jumbo frame resevation/forwarding does not increase the MTU automatically - you need to explicitly raise your MTU.

You can leave failover interface as is.

sysopt connection tcpmss and MTU of 9216

Jay Johnston — Thu, 20 Dec 2012 22:52:12 GMT

This is now documented online:

ASA: Receiving and Transmitting Jumbo Ethernet Frames

http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a0080bd7524.shtml