topic Re: ip tcp adjust-mss on FTD with FMC in Network Security

ip tcp adjust-mss on FTD with FMC

ben.levin1 — Fri, 21 Feb 2020 17:25:21 GMT

Hi all,

I'm working on setting up an IKEv2/IPSec VPN tunnel from an FTD (6.2) managed by FMC to Azure. The tunnel is up and icmp is working fine but our server engineer is reporting issues with RDP and domain controller replication.

We're wondering if MTU or MSS could be causing these issues. The FTD interface MTU are currently default (1500) but I don't see a way to set ip tcp-adjust mss on the FTD. I'm not sure if there's a way to do this in FMC or via the FTD command line.

Thanks.

Re: ip tcp adjust-mss on FTD with FMC

Marvin Rhoads — Wed, 21 Aug 2019 20:47:41 GMT

You can adjust it with FMC using a Flexconfig object.

https://www.cisco.com/c/en/us/td/docs/security/firepower/623/configuration/guide/fpmc-config-guide-v623/interfaces_for_firepower_threat_defense.html#ID-2076-00000035

Re: ip tcp adjust-mss on FTD with FMC

williaat0125 — Wed, 13 Mar 2024 17:40:15 GMT

Great link. I learned that you can disable the TCP MSS value from this link. Cisco didn't show how to do this. I'm assuming that simply setting this value to 0 disables this setting. Honestly, we prefer to allow our endpoints to use their MSS setting and not have the FTD involved.

Any thoughts?

Re: ip tcp adjust-mss on FTD with FMC

MHM Cisco World — Wed, 13 Mar 2024 17:58:11 GMT

If you have issue make new post it is better

MHM

Re: ip tcp adjust-mss on FTD with FMC

GIANRICO FICHERA — Fri, 13 Mar 2026 16:20:18 GMT

I can tell you that from FDM you can create a FlexConfig object with the template ‘sysopt connection tcpmss 1350’, and then a FlexConfig Policy that uses that template. It works.