Subject: [Ipsec] Question: IPv6 fragment handling by VPN Security Gateway

From: Subha Venkataramanan <[email-masked]>
Date: Sun, 9 Jan 2005 11:53:46 -0800 (PST)

Hi List-members,
 
I have a question on how an intermediate IPv6 router
doing IPsec should handle fragments (whose size is
1280) at the protected side and that upon encryption
could become > 1280 bytes. 
 
Since Intermediate IPv6 routers are not supposed
to fragment, I suppose the security gateway device
should send a ICMP PMTU message to the node from 
which the packet originated.
 
Since the minimum MTU size that is to be supported for
IPv6 is 1280, will the end node honour this ICMP PMTU
message ?

Also should an IPv6 VPN Security Gateway support NAT
Traversal ?
 
Thanks,
Subha 

__________________________________ 
Do you Yahoo!? 
Yahoo! Mail - Find what you need with new enhanced search.
http://info.mail.yahoo.com/mail_250

_______________________________________________
Ipsec mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/ipsec

---

From: "Srinivasa Rao Addepalli" <[email-masked]>
Date: Sun, 9 Jan 2005 18:57:36 -0800

--------- Original Message
--------
From: "Subha Venkataramanan" <[email-masked]>
To:
"[email-masked]" <[email-masked]>
Subject: [Ipsec] Question: IPv6
fragment handling by VPN Security Gateway
Date: Sun 01/09/05 04:11
AM

Hi List-members,

I have
a question on how an intermediate IPv6 router
doing IPsec should handle
fragments (whose size is
1280) at the protected side and that upon
encryption
could become > 1280 bytes.

Since Intermediate IPv6
routers are not supposed
to fragment, I suppose the security gateway
device
should send a ICMP PMTU message to the node from
which the
packet originated.

SRINI>IPsec gateway is not fragmenting the
original packet. It might fragment the tunnel packet, which is anyway new
packet and originating from this device.

SRINI> Sending ICMP too
big message is still good as long as PMTU is equal or more than 1280. Note
that, the sender need not honor ICMP too big a message, if it has PMTU value
less than 1280.

Since the minimum MTU size that is to be
supported for
IPv6 is 1280, will the end node honour this ICMP
PMTU
message ?

Also should an IPv6 VPN Security Gateway support
NAT
Traversal
?

Thanks,
Subha

__________________________________
Do
you Yahoo!?
Yahoo! Mail - Find what you need with new enhanced
search.
http://info.mail.yahoo.com/mail_250

Ipsec
mailing list