Gre In Tcp Mss; Gre Out Tcp Mss; Aging - Juniper NETWORK AND SECURITY MANAGER 2010.4 - CONFIGURING SCREENOS DEVICES GUIDE REV 01 Manual

Configuring ScreenOS Devices Guide

GRE In TCP MSS

GRE Out TCP MSS

Aging

128
If the TCP MSS option for IPsec VPN traffic is not set, the security device applies the
value specified in this option for TCP packets in an IPSec VPN tunnel.
If the TCP MSS option for IPsec VPN traffic is set, the security device overrides that
value with the value from the All TCP MSS option.
When this option is disabled, the security device does not modify the MSS value of a
TCP packet in network traffic.
By default, this option is disabled.
Use the GRE in TCP MSS option to control how the security device handles the TCP MSS
value for generic routing encapsulation (GRE) packets destined for an IPsec VPN tunnel.
When this option is set to Packet Size, the security device modifies the MSS value in
a GRE packet to avoid fragmentation caused by the IPsec operation. The TCP MSS
range is 64 to 1420 bytes inclusive; the default MSS for this option is 1320.
When this option is disabled, the security device does not modify the MSS value in a
GRE packet entering an IPsec VPN tunnel.
By default, this option is disabled.
Use the GRE Out TCP MSS option to control how the security device handles the TCP
MSS value for GRE packets leaving an IPsec VPN tunnel.
When this option is set to Packet Size, the security device modifies the MSS value in
a GRE packet to avoid fragmentation caused by the IPsec operation. The TCP MSS
range is 64 to 1420 bytes inclusive; the default MSS for this option is 1320.
When this option is disabled, the security device does not modify the MSS value in a
GRE packet leaving an IPsec VPN tunnel.
By default, this option is disabled.
Use the Aging options to control how the security device uses aggressive aging to affect
session timeout. Aggressive aging begins when the number of entries in the session table
exceeds the high-watermark setting, and ends when the number of sessions falls below
the low-watermark setting. When aggressive aging is in effect, the security device ages
out sessions—beginning with the oldest sessions first—at the rate you specify.
When the session table is in any other state, the normal session timeout value is applied.
Normal session timeout intervals for common protocols:
The TCP session timeout is 30 minutes.
The UDP session timeout is 1 minute.
The HTTP session timeout is 5 minutes.
Copyright © 2010, Juniper Networks, Inc.