PCNSE · Question #742
After switching to a different WAN connection, users have reported that various websites will not load, and timeouts are occurring. The web servers work fine from other locations. The firewall enginee
The correct answer is C. Adjust the TCP maximum segment size (MSS) value.. The root cause is a path MTU mismatch: the firewall's ethernet1/1 interface has an MTU of 1500 bytes, but an upstream router interface only supports 1400 bytes. When the firewall forwards large TCP segments (up to 1460 bytes of payload), the upstream router cannot forward them an
Question
After switching to a different WAN connection, users have reported that various websites will not load, and timeouts are occurring. The web servers work fine from other locations. The firewall engineer discovers that some return traffic from these web servers is not reaching the users behind the firewall. The engineer later concludes that the maximum transmission unit (MTU) on an upstream router interface is set to 1400 bytes. The engineer reviews the following CLI output for ethernet1/1. Which setting should be modified on ethernet1/1 to remedy this problem?
Exhibit
Options
- AChange the subnet mask from /23 to /24.
- BLower the interface MTU value below 1500.
- CAdjust the TCP maximum segment size (MSS) value.
- DEnable the Ignore IPv4 Don't Fragment (DF) setting.
How the community answered
(47 responses)- A17% (8)
- B4% (2)
- C70% (33)
- D9% (4)
Explanation
The root cause is a path MTU mismatch: the firewall's ethernet1/1 interface has an MTU of 1500 bytes, but an upstream router interface only supports 1400 bytes. When the firewall forwards large TCP segments (up to 1460 bytes of payload), the upstream router cannot forward them and drops the packets - especially if the DF (Don't Fragment) bit is set. The correct fix is to lower the TCP Maximum Segment Size (MSS) on ethernet1/1. MSS adjustment causes the firewall to modify the MSS value in TCP SYN and SYN-ACK packets, telling endpoints to send no more than the adjusted segment size. This ensures all TCP data fits within the 1400-byte upstream MTU without fragmentation or drops. Changing the subnet mask (A) is irrelevant. Lowering the interface MTU (B) would cause fragmentation issues. Enabling 'Ignore DF' (D) would force fragmentation rather than preventing oversized segments at the source.
Topics
Community Discussion
No community discussion yet for this question.