FreeBSD 6.1 IPsec Path MTU Discovery

[Johann Hugo]

On Tuesday 07 November 2006 19:39, Tom Judge wrote:
> Hi,
>
> I am seeing some problems with some problems with IPsec encrypted gif
> tunnels and path mtu discovery.
>
> It seems that the router with the IPsec tunnel sends an ICMP need to
> frag packet with the next hop mtu set to 0. This causes ssh to
> retransmit a the same packet without reducing the size of the data payload.
>
> Is this a know problem? If so are there any know work arounds?

I'm seeing the same problem on my gif tunnel.

For an interim work around you can reduce the MTU size between Box1 and Box2 
e.g "route change Box2 -mtu 1200". After it's starts working you can change it 
back to 1500 en it keeps on working. 
 
Don't ask me why it works, I'm still trying to figure out what the problem is.

Johann