Dear Colleagues, I've set up IPSec in transport mode between two regular FreeBSD hosts, for testing. Now TCP sessions between those hosts don't work normally any more. For example, scp is stalled almost immediately after starting a file transfer, and so is interactive ssh eventually.
I feel that the problem is somehow related to MTU, MSS and fragmentation
of ESP packets, because:
1. When IPSec is disabled, I can "ping -s1472 -D" the remote host all
right.
2. When IPSec is enabled, the maximum packet size I've been able to send
through is "ping -s1414 -D". ("ping -s1415 -D host-b" already disappears
in the void).
I'm really at a loss what to do about that. In transport mode, there is
no network interface I could adjust MTU on, or run some kind of MSS
fixer.
PS And I'm talking about IPv4 only for now, but "{scp, ssh} -6" is stalling too.
--
Victor Sudakov, VAS4-RIPE, VAS47-RIPN
2:5005/49@fidonet http://vas.tomsk.ru/
signature.asc
Description: PGP signature
