don't-fragment-flag on ftp & icmp

[CJ Gibson <cjgibson@xxxxxxxxxxxxxxxx>]

I have a question about encryption: 
My IPSec implementation sits on an Ethernet LAN which has a max PDU size
of 1500. I've noticed that ftp builds IP packets at this max size and
then sends them with the don't-fragment-flag set to 1. Encryption
obviously adds bytes to the packet so how can I encrypt this without
fragmenting it? Are we supposed to ignore the flag & fragment anyway?
And how about ICMP (ping on my Sun sets the don't-fragment-flag as
well)??
What are the rest of you doing in this case??

Thanx for your input..
	CJ