tcp fragmentation

[Carl King]

Is there a way to turn on tcp fragmentation? If not is it possible to enable tcp-mss limits for a content rule on any layer 5 option other than "url"/*"".

We are trying to LB RDP connections on port 3389 over VPN and find that we are forced to lower the MTU on each workstation to make the connections. The documentation says tcp-mss only works on layer 5 rules but the only option I can find for layer 5 pertains to http.

Any tips?

Carl King

[seilsz]

Carl,

The command you are looking for is in global configuration mode:

CSS11506(config)# flow tcp-mss ?

Integer value(Range: 1-1460)

CSS11506(config)#

This will only be applicable to L5 content rules.

Do RDP connections work through the CSS without a VPN involved?

~Zach

[Carl King]

Yes, RDP connections work outside of the VPN. The issue is documented with workarounds suggesting client ip stack modifications. The tcp-mss will take care of the problem globally but it seems to only work on layer 5 rules. If I setup tcp-mss, it won't do any good without a layer 5 option and the url argument only applies to http connections.

http://www.cisco.com/warp/public/105/38.pdf

Carl

[Gilles Dufour]

Carl,

CSS11503(config)# tcp-ip-fragment ?

enabled Enable flow TCP IP fragment support

Gilles.

[seilsz]

Gilles,

I think Carl is asking if there is a way to have the CSS negotiate/set a lower tcp mss for non-L5 flows.

Carl,

I do not think this is possible.

~Zach

[Carl King]

Yes.

Or is there a way to LB RDP at layer 5?

Carl

[Gilles Dufour]

the initial question was 'how to enable tcp fragment ?'

I thought you wanted the CSS to handle fragments or use TCP mss to avoid fragment.

Could you describe clearly the problem so we can find the appropriate solution.

Currently you are just asking us how to do what you think is the solution.

Is RDP going through a tunnel, and being fragmented ?

or is it dropped ?

If you use L3 or L4 rule, can't you simply change the TCP MSS on the server ?

I would think the server MSS is passed by the CSS to the client.

Unless using L5 rules, in which case the CSS complete the TCP 3-way handshake on behalf of the server, so a TCP-MSS option is required to set the TCP MSS for the CSS.

Did you try changing the server ?

Regards,

Gilles.