> Lower than 1500 mtu always requires some kind of hack in real life. > > That would be the adjust-mss which is the hack-of-choice note that using 'adjust-mss' only adjusts the MSS for TCP. it won't do much good for already-encapsulated IPSec traffic with protocol 47 or tunneled over UDP... cheers, lincoln.