PIX-Exceed MSS Resolution

最新推荐文章于 2024-01-25 13:25:46 发布

原创最新推荐文章于 2024-01-25 13:25:46 发布 · 1.3k 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#interface #comments #access #server #blog #tcp

本文介绍了一个PIX防火墙MSS超出的问题场景及解决方案。当外部世界无法访问位于隔离区(DMZ)内的IP地址为192.168.1.3的Web服务器时，PIX防火墙的日志显示MSS超出。通过配置特定的访问控制列表、类映射、TCP映射和策略映射等步骤来解决此问题。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

Author Details : suyashjain Blog | suyashjain Links | India |

0 points, 4106 views Comments:

1 Comments User:

suyashjain

Message Type: %PIX-4-419001
Message Description: Exceed MSS Resolution
Device : PIX
Software Version: 7.x
Chassis: 5xx

Scenario: Out side world is not able to access the web server in DMZ with ip address 192.168.1.3.PIX syslog says that MSS exceeded, MSS 1380, data 1460 .

Diagnose: Pix is dropping the packet due to default policy.

Resolution:

pixfirewall(config)#access-list http-list2 permit tcp any host 192.168.1.3 pixfirewall(config)# pixfirewall#configure terminal pixfirewall(config)# pixfirewall(config)#class-map http-map1 pixfirewall(config-cmap)#match access-list http-list2 pixfirewall(config-cmap)#exit pixfirewall(config)#tcp-map mss-map pixfirewall(config-tcp-map)#exceed-mss allow pixfirewall(config-tcp-map)#exit pixfirewall(config)#policy-map http-map1 pixfirewall(config-pmap)#class http-map1 pixfirewall(config-pmap-c)#set connection advanced-options mss-map pixfirewall(config-pmap-c)#exit pixfirewall(config-pmap)#exit pixfirewall(config)#service-policy http-map1 interface outside