Solved

Need help configuring my Cisco ASA Firewall to extend MSS limit for outbound traffic

Posted on 2007-11-13
3
2,107 Views
Last Modified: 2008-10-20
I have a Cisco ASA 5510 firewall and my company uses a third party POP3 providor for email.
I have just installed a Konica Multi-purpose copier that can scan a document and email it. However, when I do this, my firewall stops it with the message:
Dropping TCP packet from inside:10.203.15.202/1025 to outside:204.107.103.101/25, reason: MSS exceeded, MSS 1380, data 1460

I have seen how I can configure MSS to exceed for traffic coming in, but how can I configure it for traffic going out
0
Comment
Question by:eleeexpertsexchange
3 Comments
 
LVL 28

Accepted Solution

by:
batry_boy earned 250 total points
ID: 20276536
Try these statements:

access-list mss_allow_list extended permit tcp any host 204.107.103.101
tcp-map tcp-mss-map
  exceed-mss allow
class-map mss-map
 match access-list mss_allow_list
policy-map mss-map
 class mss-map
  set connection advanced-options tcp-mss-map
service-policy mss-map interface outside
0
 

Author Comment

by:eleeexpertsexchange
ID: 20276812
This works. Thanks very much

0
 
LVL 1

Expert Comment

by:Eirejp
ID: 34236429
No luck I am afraid.

I applied the configuration without error but one command did not show up in the show run as if it was already the default.
"exceed-mss allow"

So it looks like it applied a empty policy to the external interface. I tried a couple of times but the tcp-map tcp-mss-map comes up blank.

I am still see these sorts of errors in the logs.



6	Nov 30 2010	14:37:09						PMTU-D packet 1420 bytes greater than effective mtu 1050, dest_addr=[WAN IP], src_addr=[Random web site], prot=tcp

Open in new window

0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Join & Write a Comment

Quality of Service (QoS) options are nearly endless when it comes to networks today. This article is merely one example of how it can be handled in a hub-n-spoke design using a 3-tier configuration.
I recently attended Cisco Live! in Las Vegas, a conference that boasted over 28,000 techies in attendance, and a week of hands-on learning hosted by a solid partner with which Concerto goes to market.  Every year, Cisco displays cutting-edge technol…
This video discusses moving either the default database or any database to a new volume.
Here's a very brief overview of the methods PRTG Network Monitor (https://www.paessler.com/prtg) offers for monitoring bandwidth, to help you decide which methods you´d like to investigate in more detail.  The methods are covered in more detail in o…

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now