What does 'set flow all-tcp-mss' and 'set flow tcp-mss' do?
Knowledge Base ID: KB6346
Version: 5.0
Published: 24 Jun 2009
Updated: 24 Jun 2009
Categories: . Firewall/IPSec_VPN
. Traffic Engineering
. ScreenOS

Summary:
 'set flow tcp-mss' and 'set flow all-tcp-mss' are applicable to changing the MSS value with traffic through the firewall.

Problem or Goal:

Solution:

The command set flow tcp-mss and set flow all-tcp-mss can be used in cases where fragmentation can cause performance or communication problems. 
This will modify the maximum segment size (MSS) low enough below the Maximum Transmission Unit (MTU) so that fragmentation will not occur. A packet with the payload size plus all associated overhead must not exceed the MTU. Otherwise, fragmentation will occur. Overhead can include MAC headers, ethernet headers, CRC, encryption, and PPPoE.

 The set flow all-tcp-mss applies to clear-text traffic, while set flow tcp-mss applies to VPN traffic only.  In other words,  set flow tcp-mss is to change the MSS value for the SYN packet of the TCP handshake within the Tunnel, and set flow all-tcp-mss is to change the MSS value for the SYN packet of the TCP handshake outside the tunnel, clear text traffic.

TCP-MSS Functionality
The command set flow tcp-mss applies to VPN traffic only.   Note that it only affects the firewall that does the encrypting.  For example, given the following topology:

PC-A -----FW1--------VPN TUNNEL-----------FW2--------PC-B

Only FW2 is set with this command:

FW2-> set flow tcp-mss 1350

Then, if the session is established from PC-A to PC-B, PC-A sends the SYN packet via the tunnel.  FW1 does not change the TCP-MSS setting.  When the packet is received by the FW2, the TCP-MSS setting will not be changed since the packet is already decrypted.  In other words, the TCP-MSS setting will only be changed if the command is set on the firewall where the packet is encrypted, not on the firewall where the packet is getting decrypted.

If you want to change the MSS setting for the sessions originating from PC-A through the tunnel, then set flow tcp-mss 1350 has to be set in the FW1

ALL-TCP-MSS Functionality

The command set flow all-tcp-mss is required when using PPPoE, as PPPoE adds considerable overhead, and fragmentation will occur if the set flow all-tcp-mss command is not enabled.  There are also some instances where a router may not be handling fragmentation properly.  In these instances, set flow all-tcp-mss may help.  For example, if accessing a web site, and not all images are drawn, this symptom could be due to fragmentation.  Applying the set flow all-tcp-mss can resolve this issue.

Note that set flow all-tcp-mss settings apply only to the clear traffic. It is bi-directional and hence modifying the MSS value in the SYN packet for the clear traffic.

For example, in the above scenario/topology, let's say the following command is also added to FW2:

FW2-> set flow all-tcp-mss 1350


Then, when PC-A establishes a session with PC-B, FW2 will change the TCP-MSS setting for the sessions originating from PC-A to PC-B, because it applies to the packet after it is decrypted.



Note:  The command set tcp mss (without the parameter 'flow') applies to the TCP/IP stack of the firewall and is applicable to communication from/to the firewall, i.e. management of the firewall.

Purpose:
Troubleshooting