Date: Mon, 30 Oct 2006 11:38:34 +0100 From: VANHULLEBUS Yvan <vanhu_bsd@zeninc.net> To: freebsd-net@freebsd.org Subject: Re: Path MTU discovery broken in IPSec Message-ID: <20061030103834.GB9549@zen.inc> In-Reply-To: <20061027203322.X2293@gauntlet.os.org.za> References: <20061027203322.X2293@gauntlet.os.org.za>
next in thread | previous in thread | raw e-mail | index | archive | help
On Fri, Oct 27, 2006 at 09:03:35PM +0200, Khetan Gajjar wrote: > Hi. Hi. [....] > racoon does its thing, and the ipsec tunnels come up. I can ping > both sides, and there are no ipfw rules running. Connectivity via > ssh and nfs seems to work fine, as do DNS zone transfers (for very > small zones). > > Connectivity from host 2 to host 1 works perfectly. From host 1 > to host 2 however, TCP sessions break / stall / timeout. I've tried > reducing the MTU sizes from the default 1500 to 1492 on both > interfaces, and that makes no difference. Try to lower it again (or, simpler, try to lower the TCPMSS on the fly on one of the IPSec gates), to generate TCP packets with a size lower than... well, 1300 should probably be enough, but you can also try directly with a very small value (lower than 1000) to be sure it is / is not related to that. Yvan. -- NETASQ http://www.netasq.com
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?20061030103834.GB9549>