TCP MSS Physical interface settings understanding?

[Silvs13]

Hi, 

Can someone confirm if my Understanding for PA "Adjust the TCP MSS" is correct? 

Reference to this link this is how PA Firewall "Adjust the TCP MSS" value in the physical interface.

In other Vendor when we configured the TCP-MSS value we usually set the "Actual bytes"

Example for cisco: "ip tcp adjust-mss 1390"

In PA firewall, it looks like the MSS adjustment works by reducing the MSS value. If we want an MSS of 1390, we must subtract it from 1500.

-1500 - 1390 = 110.

Therefore the "Adjust TCP MSS" value should be 110 

[kiwi · Accepted solution]

Hi @Silvs13 ,

Select to adjust the maximum segment size (MSS) to accommodate bytes for any headers within the interface MTU byte size.

The MTU byte size minus the MSS Adjustment Size equals the MSS byte size, which varies by IP protocol:

IPv4 MSS Adjustment Size—Range is 40 to 300; default is 40.

IPv6 MSS Adjustment Size—Range is 60 to 300; default is 60.

Use these settings to address the case where a tunnel through the network requires a smaller MSS. If a packet has more bytes than the MSS without fragmentation, this setting enables the adjustment.

Encapsulation adds length to headers so it helps to configure the MSS adjustment size to allow bytes for such things as an MPLS header or tunneled traffic that has a VLAN tag.

Source: NGFW help pages.

Hope this helps,

-Kim.