Bug #16968
open
IPsec VTI max-mss Clamping Does Not Rewrite Returning TCP SYN-ACK Packets
0%
Description
When max-mss is configured on an IPsec VTI interface, MSS clamping is applied only to outbound TCP SYN packets. Returning TCP SYN-ACK packets retain their original MSS value and are forwarded to the LAN client unchanged.
The same configuration applied to a regular routed interface clamps MSS in both directions, including the returning SYN-ACK packet.
To verify the behavior, I performed lab testing using both a regular routed interface and an IPsec VTI interface with identical max-mss settings. Packet captures were collected on the transit interface (WAN/VTI) as well as the LAN interface to observe the packet values before and after forwarding.
On the regular routed interface, the outbound SYN was rewritten as expected, and the returning SYN-ACK was also rewritten before being forwarded to the LAN client.
On the IPsec VTI interface, the outbound SYN was rewritten correctly, but the returning SYN-ACK retained its original MSS value and was forwarded to the LAN client unchanged. This behavior was consistently reproduced during testing.
Files
No data to display