Hi Harald, > Problem: The mtu of this tunnel is less than 1500. On the > first run IKEv2 on my Mac fails with icmp6 "Packet Too Big". > Since the protocol is udp there is no packet to fragment and > resend, which means a 10 seconds delay until a higher network > layer wakes up and tries to authenticate again. Then it works.
Are you saying the first packet (IKE_SA_INIT) is already bigger than your MTU? Any IKE message sent later should be fragmented if you enable IKE fragmentation. And retransmits of the IKE_SA_INIT message should also be fragmented, I guess, if an ICMP was returned (unless the route cache or wherever Mac OS X stores the PMTU is not immediately updated). > Looking at this I wonder if it is reasonable to ignore 500/tcp > for Strongswan? Until [1] is standardized this won't change (it also requires kernel changes for ESP in TCP encapsulation). Regards, Tobias [1] https://tools.ietf.org/html/draft-ietf-ipsecme-tcp-encaps _______________________________________________ Users mailing list Users@lists.strongswan.org https://lists.strongswan.org/mailman/listinfo/users