sysopt connection tcpmss and MTU of 9216

[patoberli]

Hi All

We have a new ASA5585 as an internal firewall that will slowly replace our aging FWSM. For optimum performance it was adviced on the FWSM to set sysopt connection tcpmss to 0, even though using MTU of 1500.

On the new ASA are we now going to enable MTU of 9216 for the contexts. The ASA is running in transparent multicontext mode.

I read this here: http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a0080ba9521.shtml which advises against setting the tcpmss to 0. But if I understand it correct, that means that the MTU of 9216 is useless, right?

So in our case it would be needed to turn of the tcpmss feature to actually use the higher MTU?

Thanks

Pato

[Marcin Latosiewicz · Accepted solution]

Pato,

Jumbo frames support:

http://www.cisco.com/en/US/docs/security/asa/asa84/command/reference/jk.html#wp1633967

having a look at internal documentation we suggest setting MSS to 9096 (120 bytes lower tahn MTU) while typically we would set it to 40 bytes lower.

Now what you need to remember that we will use lower of the two MSSes advertised by peers.

M.

[patoberli]

Thanks for the clarification!

[ROBERTO TACCON]

Hello Marcin,

please can you clarify the following questions:

if I enable Jumbo frames support on an interface it is necessary to enable it on all the interfaces ?

if I have a cluster A/S and I enable the Jumbo frames support is it necessary to configure also the "Stateful Failover"

interface ?

as the "sysopt connection tcpmss 9096" is a global system configuration is it possible to configure only 2 interfaces with mtu 9216 and leave all other interfaces to the default 1500 ?

Best Regards

Roberto Taccon

[Marcin Latosiewicz]

Roberto.

My knowledge about this feature is from several years ago, feel free to doublecheck.

Enabling jumbo frame  resevation/forwarding does not increase the MTU automatically - you need to explicitly raise your MTU.

You can leave failover interface as is.

M.

[Jay Johnston]

This is now documented online:

ASA: Receiving and Transmitting Jumbo Ethernet Frames

http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a0080bd7524.shtml