Re: Meeting's minutes

[Bernard Aboba <aboba@xxxxxxxxxxxxx>]

>   If a stack can't handle fragmentation and reassembly then it is broken. 
> I don't think protocols should be constrained because someone's stack
> is broken. 

The problem isn't the host stack. The problem is typically with routers in
front of the VPN server. As an example, if you set an access list to allow
UDP Port 500, allow IPsec ESP/AH, then Deny ALL ou will typically not see
*any* IPsec traffic get through if the certificate payload is large
enough. 

Why? Because IKE will fragment, and the access list, while allowing the
first fragment through, will drop all succeeding fragments, since they
don't match any of the permit statements in the access list.