topic asa 5505 dsl / mtu based ssl problem in Network Security https://community.cisco.com/t5/network-security/asa-5505-dsl-mtu-based-ssl-problem/m-p/1238248#M955797 <P>Hi everyone,</P><P></P><P>We moved our office to a different location (including our dsl conncetion). We also updated our asa from 8.0.3 to 8.0.4.</P><P></P><P>Since then, I'm having trouble opening the webportal from customers having a dedicated line.</P><P></P><P>I'm getting the certificate, can confirm it but the page won't load. When setting down the MTU size on the client everything works fine. Using a DSL or UMTS Line also works like a charm.</P><P></P><P>î've set:</P><P></P><P>mtu inside 1500</P><P>mtu outside 1492</P><P>sysopt connection tcpmss 1452</P><P>crypto ipsec df-bit clear-df inside</P><P>crypto ipsec df-bit clear-df outside</P><P></P><P>i also attached an packet trace showing tcp checksum errors while loading the page.</P><P></P><P>Anybody has an idea?</P><P></P><P> </P><P></P> Fri, 21 Feb 2020 11:23:09 GMT julian 2020-02-21T11:23:09Z asa 5505 dsl / mtu based ssl problem https://community.cisco.com/t5/network-security/asa-5505-dsl-mtu-based-ssl-problem/m-p/1238248#M955797 <P>Hi everyone,</P><P></P><P>We moved our office to a different location (including our dsl conncetion). We also updated our asa from 8.0.3 to 8.0.4.</P><P></P><P>Since then, I'm having trouble opening the webportal from customers having a dedicated line.</P><P></P><P>I'm getting the certificate, can confirm it but the page won't load. When setting down the MTU size on the client everything works fine. Using a DSL or UMTS Line also works like a charm.</P><P></P><P>î've set:</P><P></P><P>mtu inside 1500</P><P>mtu outside 1492</P><P>sysopt connection tcpmss 1452</P><P>crypto ipsec df-bit clear-df inside</P><P>crypto ipsec df-bit clear-df outside</P><P></P><P>i also attached an packet trace showing tcp checksum errors while loading the page.</P><P></P><P>Anybody has an idea?</P><P></P><P> </P><P></P> Fri, 21 Feb 2020 11:23:09 GMT https://community.cisco.com/t5/network-security/asa-5505-dsl-mtu-based-ssl-problem/m-p/1238248#M955797 julian 2020-02-21T11:23:09Z Re: asa 5505 dsl / mtu based ssl problem https://community.cisco.com/t5/network-security/asa-5505-dsl-mtu-based-ssl-problem/m-p/1238249#M955801 <HTML><HEAD></HEAD><BODY><P>Julian,</P><P></P><P>You are contributing to the issue with "sysopt connection tcpmss 1452"</P><P></P><P>Change it back to the default "1380" or lower - I suggest lower I use "1300"</P><P></P><P>And the commands</P><P>crypto ipsec df-bit clear-df inside </P><P>crypto ipsec df-bit clear-df outside </P><P></P><P>AFAIK they do not apply to the SSL connections</P></BODY></HTML> Fri, 03 Apr 2009 21:45:50 GMT https://community.cisco.com/t5/network-security/asa-5505-dsl-mtu-based-ssl-problem/m-p/1238249#M955801 andrew.prince 2009-04-03T21:45:50Z