When do IP packets get reassembled if fragmentation occurs in a tunnel?

Question

I've read that fragmented IP packets "always" become reassembled at their ultimate destination, e.g. the recipient host. (see for instance http://www.tcpipguide.com/free/t_IPMessageReassemblyProcess.htm)

But what happens if the packets traverse a path where there is a VPN such as a IPsec running in tunnel mode, where the IPsec endpoints routers are not the ultimate destination, and the encrypting endpoint fragments the packets? Shouldn't packets get reassembled at the decrypting endpoint?

For instance, in the diagram below assume PC1 sends packets to PC2 and there is a tunnel between R1 and R2. Packets become fragmented at R1. Do they become reassembled at R2 or at PC2?

Answer 1

I've read that fragmented IP packets "always" become reassembled at their ultimate destination, e.g. the recipient host.

That was the original intent of the Designers of IP, it's not so true nowadays though. Many firewalls will defragment packets because it's difficult to do effective firewalling on fragments.

For instance, in the diagram below assume PC1 sends packets to PC2 and there is a tunnel between R1 and R2. Packets become fragmented at R1. Do they become reassembled at R2 or at PC2?

It depends on how they are fragmented.

If they are fragmented before encapsulation then the fragmented packets can travel seperately to the end host (though as mentioned above many firewalls will defragment them)

On the other hand if the encapsulated packet is fragmented then it must be reassembled before it can be de encapsulated.

Answer 2

Imagine a situation when packet arrives at the first router and it's size is nearly to the MTU of the physical egress port of the router, then it is encapsulated with IPSEC headers. Those additional headers will probably exceed the MTU of the egress port

In such situation the packet is going to be fragmented after encryption - post-fragmentation. Of course this forces the remote IPsec peer to perform reassembly before decryption.

You can avoid post-fragmentation if you set the MTU in the upstream data path to ensure that fragmentation occurs before encryption (prefragmentation). Prefragmentation is really important from performance perspective because it is moving the reassembly task from the remote IPSEC peer to the end host.