Quantcast
Channel: All SRX Services Gateway posts
Viewing all articles
Browse latest Browse all 17645

Re: TCP MSS and IPsec VPN

$
0
0

Hi, 

 

As I understand, when the server sees the SYN packet the TCP MSS should have been adjusted to 1350 by SRX1, however the server may not reply with an MSS of 1350. The payload could be higher depending on its MTU:

This Maximum Segment Size (MSS)
   announcement (often mistakenly called a negotiation) is sent from the
   data receiver to the data sender and says "I can accept TCP segments
   up to size X". The size (X) may be larger or smaller than the
   default.  The MSS can be used completely independently in each
   direction of data flow.  The result may be quite different maximum
   sizes in the two directions.

RFC879

 

Devices may wish to use a larger MSS if they know for a fact that the MTUs of the networks the segments will pass over are larger than the IP minimum of 576. This is most commonly the case when large amounts of data are sent on a local network; PMTUD is used to determine the appropriate MSS.

http://www.tcpipguide.com/free/t_TCPSlidingWindowDataTransferandAcknowledgementMech.htm

 

I understand when a large IPSec packet is received by SRX1 it will send ICMP destination unreachable Fragmentation needed and DF set [ICMP Type 3 Code 4]. If icmp is filtered on the other end of the tunnel, PMTUD is not possible and the packet size will not be adjusted.

 

Maybe you could check this on SRX2 if you see any ICMP Type 3 Code 4.

 

Cheers,

Ashvin


Viewing all articles
Browse latest Browse all 17645

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>