Well this sort of worked. The interface was sitting quite happily at 1500mtu and I tested that I could ping without fragmentation: C:\Users\Administrator>ping -f -l 1472 github.com Pinging github.com [192.30.253.112] with 1472 bytes of data: Reply from 192.30.253.112: bytes=1472 time=86ms TTL=56 Reply from 192.30.253.112: bytes=1472 time=86ms TTL=56 Reply from 192.30.253.112: bytes=1472 time=87ms TTL=56 Reply from 192.30.253.112: bytes=1472 time=87ms TTL=56 Ping statistics for 192.30.253.112:     Packets: Sent = 4, Received = 4, Lost = 0 (0% loss), Approximate round trip times in milli-seconds:     Minimum = 86ms, Maximum = 87ms, Average = 86ms Which worked fine. But now this morning, it's back to 1492 and fragmenting again. One thing I did notice when it was working ok was that my WAN interface didn't appear to have an IPv6 address, but now it does. IPv6 was still working without it though.

Everything is working fine  :D I only had a problem on the ubiquiti APs: SLAAC assign duplicated IPs on bridge interfaces inside the AP causing ARP loops. Disabling ipv6 support in the AP solves the issue

Any downside in using such configuration ? If we can use PF sense as a PPPoE server also, then it will help us to avoid another thing (Box) as PPPoE server.

500 Devices and, in particular, 40Mbit/s is just not that much. Probably should be looking at your virtual environment instead of the firewall.

than as stated couple of times already put in a host override for the fqdn you want to use to access your server and point it to the private IP of your server.

I think it's the way it's written, it's misleading to say the least.

See above. (Assumes you have at least a public IP on your LAN. If it's RFC1918 or CGN, tough cookies…)

"Wait five minute or a restart of pfSense may require You can test in any browser. All Done !!" I have over a thousand people connected at the minute. I will reboot at a quieter time and report back.

did some more looking arround. I've implemented the following. https://forum.pfsense.org/index.php/topic,17243.0.html https://forum.pfsense.org/index.php?topic=51786.0 It looks like it will probably resolve the issue.

Problem solved with update.

If you don't do layer3 routing on your cisco just connect a trunk of tagged vlans to pfsense, configure the vlans on the parent physical interface and create one interface for every vlan. Assign ip according to your subnets.

So your saying your not seeing gig?  Do you have gig wan?  Unless your wan is gig and your only seeing like 800 or something I don't see what your trying to squeeze out here?

you got some sort of asymmetrical issue if your not seeing the full handshake and then traffic would be my guess. Setting state to sloppy is not something you should have to do. Can you layout your connectivity - how many vswitches?  How many physical interfaces - what is the setting do you have on the vswitch that has tagged vlans?