how big (MTU size) are ipsec packets ?

['chris']

hi

how big (MTU size) are ipsec packets sending over the vpn tunnel ?

and what means if the machine (AS400) has following Maximum Transmission Unit settings:
The maximum transmission unit (MTU) is the MTU of the interface that is associated with this route.

snifer says by AS400
“Don’t Ffragment Flag“ (DF) im IP-Header.

could be that a problem between AS400 and remote VPN clients ?

kind regards
chris

[Steven E. Protter]

Couple of possible issues:

Packet size could be it.

To find out:

tcpdump -i eth# > /tmp/file

replace the # with a real eth number
Then you'll get the packet sizes.

Also see if the VPN requires a certificate exchange before being valid. Thats a recent Microsoft "enhancements"

SEP

[Olivier Drouin]

yup, take for example a client with a MTU of 1500 and is setting the 'dont fragment' header flag. If the router allows max MTU size of 1000 then the clients packet will be discarded.