Chrome OS MTU Support

The virtual adapter MTU was calculated based on the physical adapter MTU (of the host machine) and the MTU sent by the Ivanti Connect Secure.

Basically, the formula used to calculate the virtual adapter MTU is:

MIN (Physical Adapter MTU, MTU from Ivanti Connect Secure, TCP MSS value + 40)

Following is a scenario where Firewall on the data path is stripping the TCP MSS options being advertised by the Ivanti Connect Secure to Ivanti Secure Access Client. In this scenario, the TCP MSS value on Ivanti Secure Access Client will default to a minimum value of 536, and as a result the client-side MTU calculation results in a minimum MTU value of 576. Here, customer wants to ignore the TCP MSS options while calculating the Virtual Adapter MTU calculation.

If the administrator configures the Ivanti Connect Secure server with the following XML input in “Advanced Client Configuration for Ivanti Secure Access Client” option, it will ignore TCP MSS options while calculating the virtual adapter MTU on client side.

1. Select System > Configuration > Advanced Client Configuration to display the configuration page.

2. Enter the following XML input in “Advanced Client Configuration for Ivanti Secure Access Client”.

3.Click Save Changes.

The advanced configuration setting "ignore-tcp-mss" is Layer3 Adapter configuration setting and this will be consumed by Ivanti Secure Access Client as part of the IpsecConfig.

This “ignore-tcp-mss” setting is applicable for the virtual adapter MTU calculation only for IPv4. By default the setting is always false, and therefore the TCP MSS options are always considered for MTU by default. Admin has to explicitly set the ignore-tcp-mss setting to TRUE (case-insensitive), to ignore the TCP MSS.