Skip to content

Commit 4e56261

Browse files
marciocloudflaremarciocloudflare
committed
added partials for clamping
conditinal render partiasl
1 parent a3ec63f commit 4e56261

File tree

5 files changed

+35
-33
lines changed

5 files changed

+35
-33
lines changed

‎src/content/docs/magic-transit/reference/mtu-mss.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ sidebar:
88
import { Render } from "~/components";
99

1010
<Render
11-
file="mtu-mss"
11+
file="mtu-mss/mtu-mss"
1212
params={{
1313
magicProduct: "Magic Transit",
1414
productName: "Magic Transit"

‎src/content/docs/magic-wan/reference/mtu-mss.mdx‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ sidebar:
88
import { Render } from "~/components";
99

1010
<Render
11-
file="mtu-mss"
11+
file="mtu-mss/mtu-mss"
1212
product="magic-transit"
1313
params={{
1414
magicProduct: "Magic WAN",

‎src/content/partials/magic-transit/mtu-mss/mss-clamping-gre.mdx‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
---
2+
{}
3+
---
4+
5+
The MSS value depends on how your network is set up.
6+
7+
- **Magic Transit ingress-only traffic (DSR):**
8+
9+
- **On your edge router transit ports**: Apply a TCP MSS clamp with a maximum of 1,436 bytes.
10+
- **On any IPsec/GRE tunnels with third parties on your Magic Transit prefix**: Apply the MSS clamp on the internal tunnel interface (most likely on a separate firewall behind the GRE-terminating router) to reduce the current value by 24 bytes.
11+
12+
- **For Magic Transit ingress + egress traffic:**
13+
14+
- **On the Magic Transit GRE tunnel internal interface**: Meaning where the Magit Transit egress traffic will traverse. This may be done automatically once the tunnel is configured but it depends on your devices. The TCP MSS clamp should be 1,436 bytes maximum.
15+
- **On any IPsec/GRE tunnels with third parties on your Magic Transit prefix**: On the internal tunnel interface (most likely on a separate firewall behind the GRE-terminating router) to reduce its current value by 24 bytes.

‎src/content/partials/magic-transit/mtu-mss/mss-clamping-ipsec.mdx‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,15 @@
1+
---
2+
{}
3+
---
4+
5+
For IPsec tunnels, the value you need to specify depends on how your network is set up. The MSS clamping value will be lower than for GRE tunnels, however, since the physical interface will see IPsec-encrypted packets, not TCP packets, and MSS clamping will not apply to those.
6+
7+
- **Magic Transit ingress-only traffic (DSR):**
8+
9+
- **On your edge router transit ports**: TCP MSS clamp should be 1,360 bytes maximum.
10+
- **On any IPsec/GRE tunnels with third parties on your Magic Transit prefix**: on the internal tunnel interface (most likely on a separate firewall behind the GRE-terminating router) to reduce its current value by 140 bytes.
11+
12+
- **Magic Transit ingress + egress traffic:**
13+
14+
- **On your edge router**: Apply this on your Magic Transit IPsec tunnel internal interface (that is, where the Magic Transit egress traffic will traverse). This may be done automatically once the tunnel is configured but it depends on your devices. TCP MSS clamp should be 1,360 bytes maximum.
15+
- **On any IPsec/GRE tunnels with third parties on your Magic Transit prefix**: on the internal tunnel interface (most likely on a separate firewall behind the IPsec-terminating device in your premises) to reduce its current value by 140 bytes.

‎src/content/partials/magic-transit/mtu-mss.mdx‎ renamed to ‎src/content/partials/magic-transit/mtu-mss/mtu-mss.mdx‎

Lines changed: 3 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ params:
44
- productName
55
---
66

7-
import { AnchorHeading } from "~/components";
7+
import { AnchorHeading, Render } from "~/components";
88
import { Image } from 'astro:assets';
99
import dsr from "~/assets/images/magic-transit/mtu-mss/dsr.png"
1010
import tunnel from "~/assets/images/magic-transit/mtu-mss/tcp-mss.png"
@@ -102,21 +102,7 @@ Cloudflare only recommends applying a MSS clamp to adjust the size of TCP packet
102102

103103
{ props.magicProduct === "Magic Transit" && (
104104
<>
105-
<p>The MSS value depends on how your network is set up.</p>
106-
<ul>
107-
<li><strong>Magic Transit ingress-only traffic (DSR):</strong>
108-
<ul>
109-
<li><strong>On your edge router transit ports:</strong> Apply a TCP MSS clamp with a maximum of 1,436 bytes.</li>
110-
<li><strong>On any IPsec/GRE tunnels with third parties on your Magic Transit prefix:</strong> Apply the MSS clamp on the internal tunnel interface (most likely on a separate firewall behind the GRE-terminating router) to reduce the current value by 24 bytes.</li>
111-
</ul>
112-
</li>
113-
<li><strong>For Magic Transit ingress + egress traffic:</strong>
114-
<ul>
115-
<li><strong>On the Magic Transit GRE tunnel internal interface:</strong> Meaning where the Magic Transit egress traffic will traverse. This may be done automatically once the tunnel is configured but it depends on your devices. The TCP MSS clamp should be 1,436 bytes maximum.</li>
116-
<li><strong>On any IPsec/GRE tunnels with third parties on your Magic Transit prefix:</strong> On the internal tunnel interface (most likely on a separate firewall behind the GRE-terminating router) to reduce its current value by 24 bytes.</li>
117-
</ul>
118-
</li>
119-
</ul>
105+
<Render file="mtu-mss/mss-clamping-gre" />
120106
</>
121107
)
122108
}
@@ -134,21 +120,7 @@ Cloudflare only recommends applying a MSS clamp to adjust the size of TCP packet
134120

135121
{ props.magicProduct === "Magic Transit" && (
136122
<>
137-
<p>For IPsec tunnels, the value you need to specify depends on how your network is set up. The MSS clamping value will be lower than for GRE tunnels, however, since the physical interface will see IPsec-encrypted packets, not TCP packets, and MSS clamping will not apply to those.</p>
138-
<ul>
139-
<li><strong>Magic Transit ingress-only traffic (DSR):</strong>
140-
<ul>
141-
<li><strong>On your edge router transit ports:</strong> TCP MSS clamp should be 1,360 bytes maximum.</li>
142-
<li><strong>On any IPsec/GRE tunnels with third parties on your Magic Transit prefix:</strong> on the internal tunnel interface (most likely on a separate firewall behind the GRE-terminating router) to reduce its current value by 140 bytes.</li>
143-
</ul>
144-
</li>
145-
<li><strong>Magic Transit ingress + egress traffic:</strong>
146-
<ul>
147-
<li><strong>On your edge router:</strong> Apply this on your Magic Transit IPsec tunnel internal interface (that is, where the Magic Transit egress traffic will traverse). This may be done automatically once the tunnel is configured but it depends on your devices. TCP MSS clamp should be 1,360 bytes maximum.</li>
148-
<li><strong>On any IPsec/GRE tunnels with third parties on your Magic Transit prefix:</strong> on the internal tunnel interface (most likely on a separate firewall behind the IPsec-terminating device in your premises) to reduce its current value by 140 bytes.</li>
149-
</ul>
150-
</li>
151-
</ul>
123+
<Render file="mtu-mss/mss-clamping-ipsec" />
152124
</>
153125
)
154126
}

0 commit comments

Comments
 (0)