close

keyboard_arrow_left

Table of Contents Expand all

list Table of Contents

English

tcp-options (Security Policies)

date_range 14-Dec-23

arrow_backward

arrow_forward

Syntax

content_copy zoom_out_map
tcp-options {
    initial-tcp-mss mss-value;
    reverse-tcp-mss mss-value;
    sequence-check-required;
    syn-check-required;
    window-scale;
}

Hierarchy Level

[edit logical-systems logical-systems-name security policies explicit-proxy profile name policy policy-name from then permit]
[edit logical-systems logical-systems-name security policies-zone  from-zone zone-name to-zone zone-name policy policy-name then permit]
[edit logical-systems logical-systems-name security policies global policy policy-name then permit]
[edit logical-systems logical-systems-name  security policies policy-set policy-policy-set-name policy policy-name then permit]
[edit logical-systems logical-systems-name security policies policy-set policy-set-name policy policy-name then permit]   

[edit logical-systems logical-systems-name tenants tenants-tenants-systems-name security policies explicit-proxy profile policy-name policy policy-name from then]
[edit logical-systems logical-systems-name tenants tenants-systems-name security policies-zone  from-zone zone-name to-zone zone-name policy policy-name then permit]
[edit logical-systems logical-systems-name tenants tenants-tenants-systems-name security policies  global policy policy-name then permit]
[edit logical-systems logical-systems-name tenants tenants-tenants-systems-name security policies policy-setset policy-set-name policy policy-name then permit]
[edit security policies explicit-proxy profile policy-set-policy-name policy policy-name then permit]
[edit security policies from-zone zone-name to-zone zone-name policy policy-name then permit]
[edit security policies policiesglobal from-zone zone-name to-zone zone-name policy policy-name then permit  then permit]
[edit security policies policies policy-set policy-policy-set-name policy policy-name then permit]
[edit tenants tenants-systems-name securitypolicies policies policyexplicit-setproxy profile policy-set-name policy policy-name then permit]
[edit tenants tenants-systems-name security policies from-zone zone-name to-zone zone-name policy policy-name then permit]
[edit tenants tenants-systems-name security policies global policy policy-name then permit]
[edit tenants tenants-systems-name security policies policy-set policy-set-name policy policy-name then permit]

Description

Specify the TCP options for each policy. You can configure sync and sequence checks for each policy based on your requirements, and, because each policy has two directions, you can configure a TCP MSS value for both directions or for just one direction. To configure per-policy TCP options, you must turn off the respective global options. Otherwise, the commit check will fail.

Note:

TCP maximum segment size (MSS) does not have a default value. The value is determined either from policy configuration or from flow configuration.

Example:

[set security flow tcp-mss all-tcp mss mss-value]

The priority for setting the MSS is given to the policy-level configuration. If there are no configurations at both the policy and flow levels, then the MSS indicated by the respective endpoint will remain as it is.

See tcp-mss (Security Flow) for details.

Note:

TCP maximum segment size (MSS) does not have a default value. The value is determined either from policy configuration or from flow configuration.

Example:

[set security flow tcp-mss all-tcp mss <mss-value>]

See tcp-mss (Security Flow) for details.

Options

initial-tcp-mss	Configure the TCP maximum segment size (MSS) for packets that arrive at the ingress interface (initial direction), match a specific policy, and for which a session is created. The value you configure overrides the TCP MSS value in the incoming packet when the value in the packet is higher than the one you specify. The `initial-tcp-mss` value per policy takes precedence over a global `tcp-mss` value (`all-tcp`, i`psec-vpn`, `gre-in`, `gre-out`), if one is configured. However, when the `syn-flood-protection-mode syn-proxy` statement at the `[edit security flow]` hierarchy level is used to enable SYN proxy defenses against SYN attacks, the TCP MSS value is not overriden. Because each policy has two directions, you can configure a value for both directions or for just one direction. To configure a TCP MSS value for the reverse session, use the `reverse-tcp-mss` option. Range: 64 through 65535
reverse-tcp-mss	Configure the TCP maximum segment size (MSS) for packets that match a specific policy and travel in the reverse direction of a session. The value you configure replaces the TCP MSS value when the value in the packet is higher than the one you specify. The `reverse-tcp-mss` value per policy takes precedence over a global `tcp-mss` value (`all-tcp`, `ipsec-vpn`, `gre-in`, `gre-out`), if one is configured. However, when the `syn-flood-protection-mode syn-proxy` statement at the `[edit security flow]` hierarchy level is used to enable SYN proxy defenses against SYN attacks, the TCP MSS value is not overridden. Because each policy has two directions, you can configure a value for both directions or for just one direction. To configure the TCP MSS value for the initial session, use the `initial-tcp-mss` option. Range: 64 through 65535
sequence-check-required	Enable sequence check per policy. The sequence-check-required value overrides the global value no-sequence-check.
syn-check-required	Enable sync check per policy. The syn-check-required value overrides the global value no-syn-check.
window-scale	Enable window-scale per policy.

Required Privilege Level

security—To view this statement in the configuration.

security-control—To add this statement to the configuration.

Release Information

The tcp-options, sequence-check-required, and syn-check-required statements are introduced in Junos OS Release 10.4.

The initial-tcp-mss and reverse-tcp-mss statements are introduced in Junos OS Release 12.3X48-D20.

The window-scale statement is introduced in Junos OS Release 15.1X49-D70.

arrow_backward PREVIOUS tcp-non-syn

NEXT arrow_forward tcp-rst

Junos CLI Reference

ON THIS PAGE

tcp-options (Security Policies)

Syntax

Hierarchy Level

Hierarchy Level

Description

Options

Required Privilege Level

Release Information

Stay in touch

Helped me install or use the product
Accelerated my deployment

Discuss the product with a co-worker
Make a purchase inquiry

Junos CLI Reference

ON THIS PAGE

tcp-options (Security Policies)

Syntax

Hierarchy Level

Hierarchy Level

Description

Options

Required Privilege Level

Release Information

Related Documentation

Stay in touch