{"id":25506,"date":"2021-08-16T17:17:51","date_gmt":"2021-08-16T09:17:51","guid":{"rendered":"https:\/\/blog.club22sg.com\/?p=25506"},"modified":"2021-08-16T17:17:51","modified_gmt":"2021-08-16T09:17:51","slug":"how-does-mss-affect-the-internet-access","status":"publish","type":"post","link":"https:\/\/blog.club22sg.com\/?p=25506","title":{"rendered":"How does MSS affect the Internet Access"},"content":{"rendered":"\n<p>In the recent Barracuda CloudGen Firewall Demo lab, I encountered a strange scenario; a Windows 10 PC can access some HTTPS websites, such as Google, Youtube, and Barracuda.com. However, this PC can&#8217;t open other HTTPS websites, such as Yahoo. The same thing happens to other Windows PC and Ubuntu Desktop that under the same network segment. What could be the root cause?&nbsp; How can we carry out the troubleshooting?<\/p>\n\n\n\n<p><strong>Network Diagram and Description: <\/strong><\/p>\n\n\n\n<p>This Demo lab environment includes a Home Router, Barracuda CloudGen Firewall F18, Layer 2 Switch, One Windows PC: WIN10-DMZ, and IP:192.168.60.25 in the default VLAN\/DMZ-NET 192.168.60.0\/24; and the second Windows 10 PC WIN10-LAN, and IP: 192.168.80.12 in the VLAN20\/LAN-NET Network192.168.80.0\/24.<\/p>\n\n\n\n<p>WIN10-DMZ (192.168.60.25) can access the Internet without any issue. However, WIN10-LAN (192.168.80.12) can open Google and Barracuda.com websites but can&#8217;t open the Yahoo website.<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"546\" src=\"https:\/\/18.141.42.182\/wp-content\/uploads\/2021\/08\/MSS-FW-1024x546.jpg\" alt=\"\" class=\"wp-image-25550\" srcset=\"https:\/\/blog.club22sg.com\/wp-content\/uploads\/2021\/08\/MSS-FW-1024x546.jpg 1024w, https:\/\/blog.club22sg.com\/wp-content\/uploads\/2021\/08\/MSS-FW-300x160.jpg 300w, https:\/\/blog.club22sg.com\/wp-content\/uploads\/2021\/08\/MSS-FW-768x410.jpg 768w, https:\/\/blog.club22sg.com\/wp-content\/uploads\/2021\/08\/MSS-FW-1536x819.jpg 1536w, https:\/\/blog.club22sg.com\/wp-content\/uploads\/2021\/08\/MSS-FW.jpg 1725w\" sizes=\"auto, (max-width: 1024px) 100vw, 1024px\" \/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p><strong>Troubleshooting &amp; Verification:<\/strong><\/p>\n\n\n\n<p>Carry out <strong>Ping www.yahoo.com and Ping 8.8.8.8<\/strong> at WIN10-LAN PC. The result shows that basic Internet access &amp; DNS should be working.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" src=\"https:\/\/18.141.42.182\/wp-content\/uploads\/2021\/08\/PIng-1.png\" alt=\"\" class=\"wp-image-25516\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" src=\"https:\/\/18.141.42.182\/wp-content\/uploads\/2021\/08\/PIng-2.png\" alt=\"\" class=\"wp-image-25517\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>At WIN10-LAN, Run <strong>Ping www.yahoo.com -f -l 1473<\/strong><\/p>\n\n\n\n<p>-f: Set don&#8217;t fragment flag, so this Ping test will not fragment the Packet<\/p>\n\n\n\n<p>-l: the Send buffer size over this ICMP test<\/p>\n\n\n\n<p>Why do I use 1473?<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" src=\"https:\/\/18.141.42.182\/wp-content\/uploads\/2021\/08\/IP-Header.png\" alt=\"\" class=\"wp-image-25515\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>The default Maximum Transmission Unit (MTU) size of an Ethernet interface is 1500 bytes, which includes IP header 20 bytes, TCP Header 20 bytes, and Maximum Data Payload 1460 bytes.<\/p>\n\n\n\n<p>When using ICMP for this testing, the same MTU size 1500 bytes, includes IP header 20 bytes, ICMP Header 8 bytes, and Maximum Data Payload becomes 1472.<\/p>\n\n\n\n<p>MSS\/Data Payload in ICMP = 1500 (MTU) &#8211; 20 (IP Header) &#8211; 8 (ICMP)&nbsp; = 1472<\/p>\n\n\n\n<p>When using 1473 for the Ping test, the packet size is 1 byte higher than the default MTU value, and the Packet should require fragment.<\/p>\n\n\n\n<p>The result shows the Packet needs to be fragmented but DF set.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"770\" height=\"219\" src=\"https:\/\/18.141.42.182\/wp-content\/uploads\/2021\/08\/1473-1.png\" alt=\"\" class=\"wp-image-25512\" srcset=\"https:\/\/blog.club22sg.com\/wp-content\/uploads\/2021\/08\/1473-1.png 770w, https:\/\/blog.club22sg.com\/wp-content\/uploads\/2021\/08\/1473-1-300x85.png 300w, https:\/\/blog.club22sg.com\/wp-content\/uploads\/2021\/08\/1473-1-768x218.png 768w\" sizes=\"auto, (max-width: 770px) 100vw, 770px\" \/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>At WIN10-LAN, Run <strong>Ping www.yahoo.com -f -l 1472<\/strong><\/p>\n\n\n\n<p>The result shows request timed out.<strong>\u00a0 <\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"739\" height=\"214\" src=\"https:\/\/18.141.42.182\/wp-content\/uploads\/2021\/08\/1472-1.png\" alt=\"\" class=\"wp-image-25509\" srcset=\"https:\/\/blog.club22sg.com\/wp-content\/uploads\/2021\/08\/1472-1.png 739w, https:\/\/blog.club22sg.com\/wp-content\/uploads\/2021\/08\/1472-1-300x87.png 300w\" sizes=\"auto, (max-width: 739px) 100vw, 739px\" \/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>At WIN10-LAN, Run <strong>Ping www.yahoo.com -f -l 1468<\/strong><\/p>\n\n\n\n<p>The result shows the reply from Yahoo<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" src=\"https:\/\/18.141.42.182\/wp-content\/uploads\/2021\/08\/1468-1.png\" alt=\"\" class=\"wp-image-25508\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>Why WIN10-LAN PC can not use 1472 data payload for the Ping test? Why 1468 data payload can get a reply response?<\/p>\n\n\n\n<p>Anything wrong with the Router, Firewall, or switch configuration?<\/p>\n\n\n\n<p>Then, I used the default VLAN network PC WIN10-DMZ 192.168.60.25 to carry out the same test.<\/p>\n\n\n\n<p>At WIN10-DMZ <strong>Ping www.barracuda.com and Ping 8.8.8.8<\/strong><\/p>\n\n\n\n<p>The result shows that basic Internet access &amp; DNS should be working.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" src=\"https:\/\/18.141.42.182\/wp-content\/uploads\/2021\/08\/PIng-3.png\" alt=\"\" class=\"wp-image-25518\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" src=\"https:\/\/18.141.42.182\/wp-content\/uploads\/2021\/08\/PIng-4.png\" alt=\"\" class=\"wp-image-25519\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>At WIN10-DMZ, Run <strong>Ping www.barracuda.com -f -l 1473<\/strong><\/p>\n\n\n\n<p>The result shows the Packet needs to be fragmented but DF set<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" src=\"https:\/\/18.141.42.182\/wp-content\/uploads\/2021\/08\/1473-2.png\" alt=\"\" class=\"wp-image-25513\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>At WIN10-DMZ, Run <strong>Ping www.barracuda.com -f -l 1472<\/strong><\/p>\n\n\n\n<p>The result shows the reply from Barracuda.com<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"701\" height=\"262\" src=\"https:\/\/18.141.42.182\/wp-content\/uploads\/2021\/08\/1472-2.png\" alt=\"\" class=\"wp-image-25510\" srcset=\"https:\/\/blog.club22sg.com\/wp-content\/uploads\/2021\/08\/1472-2.png 701w, https:\/\/blog.club22sg.com\/wp-content\/uploads\/2021\/08\/1472-2-300x112.png 300w\" sizes=\"auto, (max-width: 701px) 100vw, 701px\" \/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p>At WIN10-DMZ, Run <strong>Ping www.yahoo.com -f -l 1472<\/strong><\/p>\n\n\n\n<p>The result shows the reply from Yahoo<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"721\" height=\"249\" src=\"https:\/\/18.141.42.182\/wp-content\/uploads\/2021\/08\/1472-3.png\" alt=\"\" class=\"wp-image-25511\" srcset=\"https:\/\/blog.club22sg.com\/wp-content\/uploads\/2021\/08\/1472-3.png 721w, https:\/\/blog.club22sg.com\/wp-content\/uploads\/2021\/08\/1472-3-300x104.png 300w\" sizes=\"auto, (max-width: 721px) 100vw, 721px\" \/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p><strong>Root Cause Analysis:<\/strong><\/p>\n\n\n\n<p>What&#8217;s the difference between DMZ-NET 192.168.60.0\/24 and LAN-NET 192.168.80.0\/24?<\/p>\n\n\n\n<p>DMZ-NET belongs to the default VLAN, and it is using untagged traffic to transmit the data.<\/p>\n\n\n\n<p>LAN-NET belongs to VLAN 20, and it requires additional 4 bytes VLAN tag in the Ethernet frame; that&#8217;s why WIN10-LAN only allows 1468 payload data for the ping, which is 4 bytes lower than WIN10-DMZ.<\/p>\n\n\n\n<p><strong>Solution:<\/strong><\/p>\n\n\n\n<p>Since the VLAN 20 is terminated at the Barracuda CloudGen Firewall, so I updated the Firewall Configuration and set the Maximum Segment Size (MSS) to 1456 for VLAN 20 subnet.<\/p>\n\n\n\n<p>MSS = Maximum Data Payload<\/p>\n\n\n\n<p>= 1500 \u2013 20 (TCP) \u2013 20 (IP) \u2013 4 (VLAN) = 1456 bytes.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img decoding=\"async\" src=\"https:\/\/18.141.42.182\/wp-content\/uploads\/2021\/08\/FW-1.png\" alt=\"\" class=\"wp-image-25514\"\/><\/figure>\n\n\n\n<p><\/p>\n\n\n\n<p><strong>Lessons Learned:<\/strong><\/p>\n\n\n\n<p>The default MTU Size of the Firewall is 1500 bytes; when a full-size data payload with 1460 bytes, together with the additional VLAN Tag 4 bytes, the total Packet Size becomes 1504 bytes; the Packet could be dropped or fragmented.<\/p>\n\n\n\n<p>However, this issue doesn&#8217;t affect all websites; it only affects websites like Yahoo that create large data payload.<\/p>\n\n\n\n<p>To resolve this issue, we should set the MSS value to 1456 at the Firewall.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the recent Barracuda CloudGen Firewall Demo lab, I encountered a strange scenario; a Windows 10 PC can access some HTTPS websites, such as Google, Youtube, and Barracuda.com. However, this PC can&#8217;t open other HTTPS websites, such as Yahoo. The same thing happens to other Windows PC and Ubuntu Desktop that under the same network [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":25503,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-25506","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-network-security"],"_links":{"self":[{"href":"https:\/\/blog.club22sg.com\/index.php?rest_route=\/wp\/v2\/posts\/25506","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.club22sg.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.club22sg.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.club22sg.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.club22sg.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=25506"}],"version-history":[{"count":0,"href":"https:\/\/blog.club22sg.com\/index.php?rest_route=\/wp\/v2\/posts\/25506\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.club22sg.com\/index.php?rest_route=\/wp\/v2\/media\/25503"}],"wp:attachment":[{"href":"https:\/\/blog.club22sg.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25506"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.club22sg.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25506"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.club22sg.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25506"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}