I'm trying to understand the MTU management when creating IPSec packets.

If a IP packets already has the MTU, the resulting IPSec packet will be too large for the outbound link.

Is there a IPSec fragmentation process to resolve this ? Like sending mutiple framgented IPSec packets, to be remuxed at the reciever.

Actually, I'm in a project which relies on adding some data on the IP packet before IPSec-transforming it. The MTU is thus critical here, because it bounds the amount of data we can add on the packet...

I've also seen that MSS size reduction is an option. How can I specify it on the uphill link ?

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Commented Aug 7, 2017 at 21:24

1 Answer 1


The VPN client can reduce the MSS. As the article you linked to shows, different clients have different values for doing so.

You don't need a separate fragmentation process, because the IP fragmentation "process" will fragment the packet if it's too big. Although from my experience, many clients will set the DF flag.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.