SGOS behaviour and compatibility
By default, RFC 1323 support is enabled.
In all current versions of SGOS an Edge SWG Proxy will set the window scale option to "6" on all SYN packets if RFC 1323 support is enabled and the TCP window size is set higher than the default of 65535.
The Edge SWG will set a window-scale of "0" if RFC 1323 support is enabled but the TCP window-size is default or smaller.
The Edge SWG will set a window-scale of "0" if RFC 1323 support is disabled.
In environments with older networking equipment, RFC 1323 support may not be fully supported which may result in the TCP Window Scaling factor to be dropped.
That could result in more TCP segments on the network and slower data transmission times.
For example, if the Edge SWG sent a SYN packet that has a Window Scale of 6 and a TCP window of 102400:
1 2010-04-14 13:42:29.003000 10.10.10.1 10.10.10.2 TCP 50704 > http [SYN] Seq=0 Win=102400 Len=0 MSS=1460 WS=6 TSV=14897848 TSER=0
but the receiving TCP didn't support RFC 1323 (which includes Window Scaling) it would interpret the Window Scaling option as non-existent (0) and the TCP Window size would be seen as 1600 bytes (2^6=64, 102400/64 = 1600). This would result in many more TCP segments over the wire and slow data transfer.
To remedy this situation one option would be to disable RFC 1323 support on the Edge SWG.
Changing the RFC 1323 support option affects both the client (client to proxy) and server (proxy to OCS) side connection.
Changing this setting should be done only after careful consideration and only if you are sure that your network devices do not support RFC 1323.
RFC 1323 support can be disabled via serial console or an SSH session.
ProxySG>enable
Enable Password:
ProxySG#config t
Enter configuration commands, one per line. End with CTRL-Z.
ProxySG#(config)show tcp-ip
RFC-1323 support: enabled
TCP Newreno support: enabled
IP forwarding: enabled
ICMP bcast echo response: disabled
ICMP timestamp echo response: disabled
Path MTU Discovery: disabled
TCP silly-window avoidance: enabled
Routing algorithm: weighted-round-robin
TCP 2MSL timeout: 120 seconds
TCP window size: 2031585 bytes
TCP Loss Recovery Mode: normal
Bypass connection keep-alive: disabled
Fast retransmit: enabled
Fast TCP FIN_WAIT_2 recycle: disabled
SCPS link bandwidth: (not configured)
SCPS interface: (not configured)
SCPS link rtt: (not configured)
SCPS processing: Disabled
ProxySG#(config)tcp-ip rfc-1323 disable
ok
ProxySG#(config)exit
ProxySG#
A reboot of the Edge SWG (ProxySG) is required for RFC1323 configuration to take effect.
How can RFC 1323 be re-enabled on the Edge SWG (ProxySG)?
ProxySG>enable
Enable Password:
ProxySG#config t
Enter configuration commands, one per line. End with CTRL-Z.
ProxySG#(config)show tcp-ip
RFC-1323 support: disabled
TCP Newreno support: enabled
IP forwarding: enabled
ICMP bcast echo response: disabled
ICMP timestamp echo response: disabled
Path MTU Discovery: disabled
TCP silly-window avoidance: enabled
Routing algorithm: weighted-round-robin
TCP 2MSL timeout: 120 seconds
TCP window size: 2031585 bytes
TCP Loss Recovery Mode: normal
Bypass connection keep-alive: disabled
Fast retransmit: enabled
Fast TCP FIN_WAIT_2 recycle: disabled
SCPS link bandwidth: (not configured)
SCPS interface: (not configured)
SCPS link rtt: (not configured)
SCPS processing: Disabled
ProxySG#(config)tcp-ip rfc-1323 enable
ok
ProxySG#(config)exit
ProxySG#
A reboot of the Edge SWG (ProxySG) is required for RFC1323 configuration to take effect.
Is it possible to disable RFC 1323 for a single connection on the Edge SWG (ProxySG)?
It is NOT possible to disable RFC 1323 for just one website. The setting is global and impacts all connections to and from the Edge SWG.