How to set the MTU/TCP MSS on interfaces
In order to best support VPN/SDWAN/VXLAN configurations we recommend the following settings on the WAN interface for the best experiences.
edit "wan1"
set mode pppoe
set allowaccess ping
set type physical
set tcp-mss 1330
set role wan
set username XXXXX
set password XXXX
set mtu-override enable
set mtu 1492
FortiOS modifies the MSS to "$TunnelMTU - 40", so may not have to touch it for IPsec interfaces.