Configurations on edge devices

This section details the configurations you need to carry on edge device using the details from the Analyze > Tunnels page in Forcepoint ONE SSE portal.

Important: The Edge device (router or firewall) must be configured to send only web traffic on TCP ports 80 and 443 over the tunnel to the Cloud-SWG. All other traffic should be routed direct to the internet. If traffic over any other ports is sent over the tunnel, it will be discarded.

Following diagram illustrates the example configurations. You need to use actual configurations to setup tunnels on your edge devices.

Note: This document shows an example environment for information and guidance only. While every effort has been made to ensure the accuracy of this information, you are strongly advised to consult the latest documentation for your edge device and test your configuration thoroughly. For detailed information on Cisco ISR IOS XE, refer to the Cisco ISR Documentation.

Maximum segment size (MSS)

The encapsulation overhead of the GRE tunnel means that TCP sessions sent over the tunnel must be limited to a lower Maximum Segment Size (MSS) than usual. Most TCP clients will propose an MSS value of 1460 bytes when connecting over an Ethernet network. The GRE encapsulation overhead comprises 24 bytes (4 bytes for the GRE header, and 20 bytes for the inner IP header).

TCP clients must use an MSS value of no more than 1436 bytes for GRE. This can often be achieved by using the MSS clamping feature of a firewall or router to ensure that any TCP traffic sent down the GRE tunnel is limited to an MSS value of 1436.

Where the WAN connection to the Forcepoint data center is using the IPoE or PPPoE protocol, the MSS value may need to be lower still, to account for the encapsulation overhead of the WAN connection.

To display the current MSS setting for your tunnel interface, use the appropriate show interface command on your edge device.