I've read that fragmented IP packets "always" become reassembled at their ultimate destination, e.g. the recipient host. (see for instance http://www.tcpipguide.com/free/t_IPMessageReassemblyProcess.htm)
But what happens if the packets traverse a path where there is a VPN such as a IPsec running in tunnel mode, where the IPsec endpoints routers are not the ultimate destination, and the encrypting endpoint fragments the packets? Shouldn't packets get reassembled at the decrypting endpoint?
For instance, in the diagram below assume PC1 sends packets to PC2 and there is a tunnel between R1 and R2. Packets become fragmented at R1. Do they become reassembled at R2 or at PC2?