-----BEGIN PGP SIGNED MESSAGE-----
"Norbert" == Norbert Wegener <nw@sbs.de> writes: Norbert> Further analysis showed, that when using a netkey kernel Norbert> instead of KLIPS and openswan-2.4.0rc1 , everything worked Norbert> as expected. So the problem seems to be only partially Norbert> causes by the fragment_size miscalculation. The main reason Norbert> seems to be related to KLIPS. Norbert Wegener
tcpdump -i ipsec0 -w /tmp/ipsec0.pcap -s 1600 tcpdump -i eth1 -w /tmp/eth0.pcap -s 1600 on the server end of things. (assuming eth1 is your external interface) I have been told that there are issues with fragmentation of transport-mode packets. Don't ask me what I think of L2TP. - -- ] Michael Richardson Xelerance Corporation, Ottawa, ON | firewalls [ ] mcr @ xelerance.com Now doing IPsec training, see |net architect[ ] http://www.sandelman.ca/mcr/ www.xelerance.com/training/ |device driver[ ] I'm a dad: http://www.sandelman.ca/lrmr/ [ -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.2.2 (GNU/Linux) Comment: Finger me for keys iQCVAwUBQwpHUoqHRg3pndX9AQGyTAP/QIeUM/TwRAAfYS0D2vCe+UJTF9ONCwN3 qv+oB+siqS0VAbC4eiJ9WQ5JmtYlREifCUsDcieKfHW82IHHVuf0lCFly8s4QBAV 3TwJLebgex+pahFeqVHu/IbJJSn6Fr9tRxybG2UO5wbZkzw5+OxjOm/uIxRPhML9 QAyO4WTKCK4= =t8OK -----END PGP SIGNATURE-----