[Openswan Users] MTU again (netkey fragmentation)

[Paul Wouters]

On Fri, 2 Mar 2007, Cameron Davidson wrote:

> It shouldn't be - the server is supposed to resend the packet with a
> smaller size. That is the entire point of DF and PMTU discovery.
>
> Most likely Benny is right - the "server" (you did say it was XP at both
> ends) is not getting the ICMP fragmentation needed messages.
> Have you run wireshark on the server? Have you checked the firewalls on
> the machine receiving these messages?

Note that because of IPsec, it is not always possible for ICMP messages
to get from a router in the middle back to the machine behind the IPsec
server to tell it to lower its mtu. That's why we need to handle this
on the ipsec server.

Paul
-- 
Building and integrating Virtual Private Networks with Openswan:
http://www.amazon.com/gp/product/1904811256/104-3099591-2946327?n=283155