SRX

 View Only

  • 1.  Changing TCP MSS on SRX

    Posted 06-27-2014 00:14

    Hi all,

     

    I want to change TCP MSS on SRX3600 for tunnel sp interfaces. As I now I can't do that for some interface (e.g. st0.100).

    For all packets entering IPSec tunnels to enable MSS override I want to use this command:

     

    set security flow tcp-mss ipsec-vpn mss 1340

     

    IP MTU is 1400, therefore I want to set TCP MSS to 1340.

     

    So If I use that command in SRX which is now working in production, can that interrupt tunnels?

     

    Thanks



  • 2.  RE: Changing TCP MSS on SRX
    Best Answer

    Posted 06-27-2014 01:27

    Hi,

     

    Changing the TCP-MSS will not cause any interruption.  What will happen is that any new sessions after the change traversing the VPN will have the new MSS value in their initial SYN packet.



  • 3.  RE: Changing TCP MSS on SRX

    Posted 06-27-2014 01:41

    Dear 



  • 4.  RE: Changing TCP MSS on SRX

    Posted 06-27-2014 01:44

    MSS is only negotiated during the 3-Way Handshake, so existing sessions will just continue as normal until they end.



  • 5.  RE: Changing TCP MSS on SRX

    Posted 09-07-2016 07:52

    This command is going to change the value Globally?  Is there any way we can change it to the specific tunnel?



  • 6.  RE: Changing TCP MSS on SRX

    Posted 09-08-2016 15:24

    Yes, this is a global command for all ipsec traffic.

     

    No, there is no per tunnel or tunnel interface setting available.

     

    https://kb.juniper.net/InfoCenter/index?page=content&id=KB30688

     



  • 7.  RE: Changing TCP MSS on SRX

    Posted 07-10-2025 10:53

    lets have correct information. ip+tcp header is 40bytes meaning if IP MTU is 1400 then tcp-mss should be 1360



    ------------------------------
    RAIN NOMM
    ------------------------------



  • 8.  RE: Changing TCP MSS on SRX

    Posted 07-19-2025 20:34

    I'm guessing that you have set this lower than standard transmission mtu of 1500. My question is why? In my endeavors I have chosen 1464 for tcpmss. 1464+40=1504. Why 1504 you ask? Because it is the upper of 1500 that will make complete round trips.

    ;-)

    Why 4 you ask, because you CAN do this.

    6, no, Not 6.

    2, yes, yes you can.

    So should blackholing be lower?

    Perhaps not.



    ------------------------------
    Adrian Aguinaga
    B.S.C.M. I.T.T. Tech
    (Construction Management)
    A.A.S. I.T.T. Tech
    (Drafting & Design)
    ------------------------------

    Original Message