Sponsored Content
Special Forums IP Networking Solaris 11 Express NAT/Router IP Fragments Post 302512234 by vectox on Saturday 9th of April 2011 08:04:05 PM
Old 04-09-2011
Some good detail in there. I also found some useful information here MSS Problems with Sun PPPoE . Additionally, I reviewed my Linux router config to see what may be "working" and found that it's likely that the following firewall rule was addressing the issue I'm now experiencing with Solaris.

Code:
iptables -I FORWARD 1 -p tcp --tcp-flags SYN,RST SYN -j TCPMSS --clamp-mss-to-pmtu

Too bad it wasn't that simple with the Solaris setup Smilie. I'll attempt to tune the Solaris setup and see how I make out.

---------- Post updated 04-09-11 at 08:04 PM ---------- Previous update was 04-08-11 at 08:16 PM ----------

It's working now...and appears to be performing, but is it optimal?...I'm not sure yet. For those who wish to tackle using Solaris as a firewall/router against a PPPoE connection, I'll put my details here.

By default, the negotiated MTU over PPPoE is going to be 1492.
Using the 1492 MTU as the model, I've knocked 40 off for a max MSS number of 1452 for the TCP stack to use.
Code:
ndd -set /dev/tcp tcp_mss_max_ipv4 1452

In addition to this I'll want to turn off Path MTU Discovery.
Code:
ndd -set /dev/ip ip_path_mtu_discovery 0

 

7 More Discussions You Might Find Interesting

1. UNIX for Advanced & Expert Users

fragments in Solaris 8

When discussing inodes and data blocks, I know Solaris creates these data blocks with a total size of 8192b, divided into eight 1024b "fragments." It stores data in "contiguous" fragments and solaris doesn't allow a file to use portions of two different fragments. If the file size permits, then the... (4 Replies)
Discussion started by: manderson19
4 Replies

2. UNIX for Dummies Questions & Answers

Installing Solaris behind a windows NAT...

Greetings, and thank you for your time. I am cracking the whip to self-teach myself Unix because I think it will be the best platform for me to really open my mind and be creative. Sadly I lack anyone experienced in Unix to nag with questions, so you will be seeing a lot of me here I am sure... (4 Replies)
Discussion started by: Dustin
4 Replies

3. IP Networking

Destination NAT using ipnat in Solaris 8

Hello People, Please can someone help me with destination IP address NAT and Port transalation using ipnat in Solaris 8. Scenario: Box A(192.168.100.1/24) and Box B (192.168.100.50/24) are connected phyically and logically(vlan) on the same network switch. Box A hosts an... (0 Replies)
Discussion started by: mandarawachat
0 Replies

4. Solaris

ipfilter solaris express

Hello, | am trying to setup ipfilter on solaris express snv_91 but I don't seem to have the following file available. /etc/ipf/pfil.ap Is this an older way of configuring the interface?, I have all the packages installed. Thanks, (1 Reply)
Discussion started by: Actuator
1 Replies

5. Solaris

Solaris Express or OpenIndiana

Simply question which should I use. correct me if I'm wrong but Solaris Express is taking the place of Opensolaris and is officially sanctioned by Oracle and OpenIndiana is what used to be OpenSolaris. If I opt for OpenIndiana is it going to follow the official Oracle Solaris releases or are... (3 Replies)
Discussion started by: michael78
3 Replies

6. Solaris

Solaris 11 Express NAT performance issues

Hi all, I decided to replace my linux router/firewall with Solaris 11 express. This is a pppoe connection directly to my server...no router boxes. I got everything setup, but the performance is terrible on the NAT....really slow. A web page that loads on the server instantly will take... (3 Replies)
Discussion started by: vectox
3 Replies

7. Solaris

OpenSolaris, Solaris, Solaris Express - differences

What are the differences between these systems? I have to use Oracle's product but I do not know who to choose (3 Replies)
Discussion started by: PtaQ
3 Replies
IP-TOKEN(8)							       Linux							       IP-TOKEN(8)

NAME
ip-token - tokenized interface identifer support SYNOPSIS
ip token { COMMAND | help } ip token { set } TOKEN dev DEV ip token { get } dev DEV ip token { list } DESCRIPTION
IPv6 tokenized interface identifer support is used for assigning well-known host-part addresses to nodes whilst still obtaining a global network prefix from Router advertisements. The primary target for tokenized identifiers are server platforms where addresses are usually manually configured, rather than using DHCPv6 or SLAAC. By using tokenized identifiers, hosts can still determine their network prefix by use of SLAAC, but more readily be automatically renumbered should their network prefix change [1]. Tokenized IPv6 Identifiers are described in the draft [1]: <draft-chown-6man-tokenised-ipv6-identifiers-02>. ip token set - set an interface token set the interface token to the kernel. Once a token is set, it cannot be removed from the interface, only overwritten. TOKEN the interface identifer token address. dev DEV the networking interface. ip token get - get the interface token from the kernel show a tokenized interface identifer of a particular networking device. Arguments: coincide with the arguments of ip token set but the TOKEN must be left out. ip token list - list all interface tokens list all tokenized interface identifers for the networking interfaces from the kernel. SEE ALSO
ip(8) AUTHOR
Manpage by Daniel Borkmann iproute2 28 Mar 2013 IP-TOKEN(8)
All times are GMT -4. The time now is 08:20 AM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy