Configurations on edge devices

This section details the configurations you need to carry on Palo Alto device using the details from the Analyze > Tunnels page on Forcepoint ONE SSE.

Note: Forcepoint ONE SSE recommends using the latest firmware for your device.

Following diagram illustrates the example configurations. You need to use actual configurations to setup tunnels on your edge devices.

Note: This document shows an example environment for information and guidance only. While every effort has been made to ensure the accuracy of this information, you are strongly advised to consult the latest documentation for your edge device and test your configuration thoroughly. For detailed information on Palo Alto OS, refer to the Palo Alto Networks Documentation.

Maximum segment size (MSS)

The encapsulation overhead of the IPsec tunnel means that TCP sessions sent over the tunnel must be limited to a lower Maximum Segment Size (MSS) than usual. Most TCP clients will propose an MSS value of 1460 bytes when connecting over an Ethernet network.

Forcepoint ONE SSE recommends setting an MSS value of no more than 1360 bytes in order to leave overhead for IPsec encapsulation. This can often be achieved by using the MSS clamping feature of a firewall or router, to ensure that any TCP traffic sent down the tunnel is limited to an MSS value of 1360.

Where the WAN connection to the Forcepoint ONE SSE datacenter is using the IPoE or PPPoE protocol, the MSS value may need to be lower still, to account for the encapsulation overhead of the WAN connection.

To display the current MSS setting for your tunnel interface, use the appropriate show command on your edge device.