MTU path discovery and IPSec

Thu Dec 4 18:18:45 UTC 2003

> On Wed, 03 Dec 2003 16:05:39 GMT, jgraun at comcast.net  said:
> 
> > 1) I assume MTU path discovery has to been in enabled on 
> each router in the path in order for it work correctly?!
> 
> Actually, no.  All that's required is that:

You also need an OS that does not set the DF-bit on every packet it sends
out. IIRC, out-of-the-box Solaris 8 is excellent at doing that. No matter
how many icmp messages it gets, it happily ignores them by insisting on
sending out frames of 1500 bytes with the DF-bit set. Makes trouble-shooting
IPSec connections, uhm.... interesting.

Cheers,

Arjan H

--- 
This message is confidential and may be privileged. Any review,
retransmission, dissemination or other use of, or taking any action with
reference to this information by persons other than the intended recipient
is prohibited. If you received this message in error, please notify the
sender by reply e-mail and delete this message from all computers. Please
note that e-mails are susceptible to change. The sender will not accept
liability for the improper or incomplete transmission of the information
contained in this message.

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20031204/3e09e0cc/attachment.html>