Re: IPsec and Path MTU

[Alexey Kuznetsov <kuznet@xxxxxxxxxxxxx>]

Hello!

> As it is, the MTU for any peer with an IPsec policy is determined
> by the MTU of its dst->path.  But this is wrong because it assigns
> a single MTU to all hosts behind an IPsec gateway, even though their
> paths may well diverge beyond the gateway.

Each SA bundle referring to a dst has pmtu derived from pmtu
of that dst. So, actually, I do not understand the question.
If the policy uses the raw IP level path dst, it inherits this pmtu.

Alexey


PS. Broadcast: guys, please, tell someone to Herbert, my e-mail is banned
at his server:

... while talking to arnor.apana.org.au.:
>>> RCPT To:<herbert@xxxxxxxxxxxxxxxxxxx>
<<< 550 mail from 194.67.69.111 rejected: administrative prohibition