Re: IPsec and Path MTU

["David S. Miller" <davem@xxxxxxxxxx>]

On Fri, 18 Jun 2004 23:33:34 -0400
Michael Richardson <mcr@xxxxxxxxxxxxxxxxxxxxxx> wrote:

> -----BEGIN PGP SIGNED MESSAGE-----
> 
> 
> >>>>> "David" == David S Miller <davem@xxxxxxxxxx> writes:
>     >> In my case, the ICMP message is not coming from the remote IPsec
>     >> gateway or a router in front of it.  It's coming from a host
>     >> behind it.  So the original IP header is in the ICMP message, in
>     >> the clear.
> 
>     David> Remote gateway is supposed to encapsulate the ICMP message
>     David> and send it back to the other gateway isn't it?
> 
> Maybe. Maybe not.
> The policy may be per-port, or based upon some other more complicated
> policy. 

The policy should therefore match the quoted packet in the ICMP message.