Differences btn sysopt connection tcp-mss / tcp-map exceed-mss allow in ASA

[pavlosd]

Hi All,

I am a bit confused, we are looking into troubleshooting some issues with MSS and I came across 2 parameters which I am not sure if they both serve the same purpose....

1) sysopt connection tcpmss 1380

According to cisco description, this sets the maximum mss to value of 1380. Does this implies that in a connection from one interface leg of the firewall to another, the MSS value btn two hosts will never "negotiate" above 1380? [in a sense Firewall, intercepts messages and changes TCP MSS value to 1380 during the TCP Handshake?]. Or is this feature only complementary to IPSEC and VPN issues?

2) tcp-excced warning. TCP Exeed warmning occurs if btn a handshake the receiver or the sender transmit data with a value higher or lower than the value mutually agreed during TCP Handshake. Has though this "mutually" agreed value have to do anything with the value of the sysopt? or it "stands" by itself?

[wong34539]

I think the sysopt connection tcpmss value is only for IPsec and VPN. The tcp-exceed warning has nothing to do with the sysopt connection tcpmss value.

[pavlosd]

Hi All,

The sysopt connection tcpmss value is related to all tcp connection through the pix/asa. Even if they are tunneled through VPN or if they go from local to local LAN PIX/ASA interfaces.

The tcp-exceed, is there to verify that the mss value agreed btn two peers is not violated. So the maximum tcp-exceed value the PIX/ASA will allow is the value of "sysopt connection tcpmss value" + 20 (TCP HDR) + 20 (IP HDR).

If someone is not using any VPN tunneling then it is safe to change the value of tcpmss to 1460 (+20 +20 = 1500).

Regards.