Symptom

The default TCP MSS value on FTD Managed by FDM is 0, which means that it is fully allowing MSS Negotiation between both end-points of the TCP connection. This can cause problems with some traffic when using VPN, PPPoE, ADSL, where a lower MSS might be required. Symptoms can include: HTTPS Sites no correctly loading, packet loss through VPN connections

Conditions

FTD Managed by FDM Using VPN/PPPoE/ADSL

Workaround

Create a new FlexConfig object with the following templates: sysopt connection tcpmss [Negate template] sysopt connection tcpmss 0 Reference: https://www.cisco.com/c/en/us/td/docs/security/firepower/660/fdm/fptd-fdm-config-guide-660/fptd-fdm-advanced.html?bookSearch=true#concept_9206B60210F14E839D0EC9ABAD4712F4

Further Problem Description