Re: IPsec and Path MTU

[Michael Richardson <mcr@xxxxxxxxxxxxxxxxxxxxxx>]

-----BEGIN PGP SIGNED MESSAGE-----


>>>>> "David" == David S Miller <davem@xxxxxxxxxx> writes:
    >> In my case, the ICMP message is not coming from the remote IPsec
    >> gateway or a router in front of it.  It's coming from a host
    >> behind it.  So the original IP header is in the ICMP message, in
    >> the clear.

    David> Remote gateway is supposed to encapsulate the ICMP message
    David> and send it back to the other gateway isn't it?

Maybe. Maybe not.
The policy may be per-port, or based upon some other more complicated
policy. 

- --
]     "Elmo went to the wrong fundraiser" - The Simpson         |  firewalls  [
]   Michael Richardson,    Xelerance Corporation, Ottawa, ON    |net architect[
] mcr@xxxxxxxxxxxxx      http://www.sandelman.ottawa.on.ca/mcr/ |device driver[
] panic("Just another Debian GNU/Linux using, kernel hacking, security guy"); [


-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.2 (GNU/Linux)
Comment: Finger me for keys

iQCVAwUBQNO0DYqHRg3pndX9AQF28QP/bSgt3W2Sp6NOh4qevn/wtTcbjfE+ku0W
KRIChkF4Npot65yQKUzkwm1aV6xxcq+jPTIrgM4BASoOtrMNug2nj7EBowTSHImK
abY8KrB2JZsCFIQpa8M0vB89gJ41ufq2NaavLsjkwsPLZZX/IYtrnd8Drt4nAT5s
MqXS3xwaoxU=
=feOK
-----END PGP SIGNATURE-----