Path MTU discovery broken in IPSec

[VANHULLEBUS Yvan]

On Fri, Oct 27, 2006 at 09:03:35PM +0200, Khetan Gajjar wrote:
> Hi.

Hi.

[....]
> racoon does its thing, and the ipsec tunnels come up. I can ping
> both sides, and there are no ipfw rules running. Connectivity via
> ssh and nfs seems to work fine, as do DNS zone transfers (for very
> small zones).
> 
> Connectivity from host 2 to host 1 works perfectly. From host 1
> to host 2 however, TCP sessions break / stall / timeout. I've tried
> reducing the MTU sizes from the default 1500 to 1492 on both
> interfaces, and that makes no difference.

Try to lower it again (or, simpler, try to lower the TCPMSS on the fly
on one of the IPSec gates), to generate TCP packets with a size lower
than... well, 1300 should probably be enough, but you can also try
directly with a very small value (lower than 1000) to be sure it is /
is not related to that.


Yvan.

-- 
NETASQ
http://www.netasq.com