Cisco Catalyst SD-WAN Network Configuration Guide, Releases 26.x and Later

PDF

Configure TCP MSS and clear dont fragment

Updated: April 24, 2026

Want to summarize with AI?

Log in

Provides comprehensive instructions for configuring TCP MSS and clear don't fragment using both CLI commands and template-based methods, enabling flexible deployment and management.

Use one of these methods to configure TCP MSS and clear dont fragment:

Configure TCP MSS and clear dont fragment using CLI commands

Follow these steps to configure TCP MSS and clear dont fragment using CLI commands:

Procedure

1.

Configure an interface type and enter the interface configuration mode.

Example:

interface Tunnel 1
2.

Enable IP processing on an interface without assigning an explicit IP address to the interface.

Example:

ip unnumbered GigabitEthernet1
3.

Configure TCP MSS and clear dont fragment.

  • Enable a maximum segment size (MSS) for TCP connections.

Example:

ip tcp adjust-mss 1460
  • Clear the Don't Fragment (DF) bit in the IPv4 packet header for packets being transmitted out the interface.

Example:

ip clear-dont-fragment

The following is an example configuration of TCP MSS:


Device(config)#interface Tunnel 1
Device(config-if)#ip unnumbered GigabitEthernet1
Device(config-if)#ip tcp adjust-mss 1460

The following is an example to configure Clear Dont Fragment option:


Device(config)#interface Tunnel 1
Device(config-if)#ip unnumbered GigabitEthernet1
Device(config-if)#ip clear-dont-fragment

Configure TCP MSS and clear dont fragment using templates

Follow these steps to configure TCP MSS and clear dont fragment using feature templates.

Procedure

1.

From the Cisco SD-WAN Manager menu, choose Configuration > Templates.

2.

Click Feature Templates.

Note

In Cisco vManage Release 20.7.1 and earlier releases, Feature Templates is titled Feature.

3.

Create a new CLI add-on feature template or edit one of the following templates. You can use any of the following feature templates to configure TCP MSS and clear dont fragment:

  • VPN Ethernet Interface

  • VPN Interface DSL IPoE

  • VPN Interface DSL PPoA

  • VPN Interface DSL PPPoE

  • VPN Interface Multilink

  • VPN Interface T1/E1

  • Cellular Interfaces
4.

Click Tunnel.

5.

Specify the MSS of TPC SYN packets passing through the Cisco IOS XE Catalyst SD-WAN device to configure TCP MSS in the tunnel TCP MSS. By default, the MSS is dynamically adjusted based on the interface or tunnel MTU so that TCP SYN packets are not fragmented.

  • Range: 552 to 1460 bytes

  • Default: None

TCP MSS affects any packet that contains an initial TCP header that flows through the router. When configured, TCP MSS is examined against the MSS exchanged in the three-way handshake. The MSS in the header is lowered if the configured setting is lower than the MSS in the header. If the MSS header value is already lower than the TCP MSS, it flows through unmodified. The host at the end of the tunnel uses the lower setting of the two hosts. If the TCP MSS is to be configured, it should be set at 40 bytes lower than the minimum path MTU.

6.

Click the Clear-Dont-Fragment option to clear the Dont Fragment bit in the IPv4 packet header for packets being transmitted out the interface. When the Don't Fragment bit is cleared, packets larger than that interface's MTU are fragmented before being sent.

Clear-Dont-Fragment clears the Don't Fragment bit when there is fragmentation needed and the Don't Fragment bit is set. For packets that don't require fragmentation, the Don't Fragment bit is not affected.

7.

Click Save or Update.