Subject: RE: a silly question

From: [email-masked]
Date: Wed, 29 Jun 2005 13:51:56 -0500

If the router that is doing IPsec is a VPN gateway performing
IPsec in tunnel mode, it can do fragmentation after adding IPsec
headers to it.  In this case, the IPsec gateway is re-originating
the packet and as a originator, it can fragment the packets.

A <--> B <=======> C <---> D
[A is talking to D. B and C are doing IPsec in tunnel mode]

In this case, I think, B can fragment the packets if needed after
encapsulating the packets inside another IPv6 packet.

- Mukesh

-----Original Message-----
From: [email-masked] [mailto:[email-masked]]On Behalf Of
ext Jeroen Massar
Sent: Tuesday, June 28, 2005 6:12 AM
To: QinKe
Cc: ipv6
Subject: Re: a silly question

On Tue, 2005-06-28 at 20:46 +0800, QinKe wrote:
> Dear all:
> 
> I am a novice about IPsec. Now I have a silly question.
> As we know, the MTU of Ethernet is 1500. IPsec will add additional
> headers to IP packet. If a packet's size is just 1500, then how will
> IPsec deal with such occasion? The packet's size will larger than 1500
> after some headers are added. So fragmentation is needed here.
> But on the other hand, IPv6 routers can't do fragmentation. So I am in confusion.

In this case the first router, actually the machine itself
(localhost/loopback) will notify, the sender, itself, that the packet is
too big. The host stack notices this and will start fragmenting.

The on-the-path routers will never fragment.

Greets,
 Jeroen

--------------------------------------------------------------------
IETF IPv6 working group mailing list
[email-masked]
Administrative Requests: https://www1.ietf.org/mailman/listinfo/ipv6
--------------------------------------------------------------------

---

From: chenhongfei <[email-masked]>
Date: Thu, 30 Jun 2005 11:54:26 +0800

Hi

The algorithm of fragment in RFC2893 described the rule of fragment in
6o4 tunnel. In this algorithm, there are four results. The result C is
not fragment if (ipv4 mtu -20) is larger than 1280 and packet is larger
than (IPv4 path MTU - 20). So I think in this case, B should judge the
MTU of output port which between B and C. Because minimum MTU is 1280 in
ipv6, so B should Send IPv6 ICMP "packet too big" and Drop packet if
packets adding IPsec headers is larger then the MTU of output port. Do
you agree?

        if (IPv4 path MTU - 20) is less than or equal to 1280
                if packet is larger than 1280 bytes
 result A               Send IPv6 ICMP "packet too big" with MTU = 1280.
                        Drop packet.
                else
 result B               Encapsulate but do not set the Don't Fragment
                        flag in the IPv4 header.  The resulting IPv4
                        packet might be fragmented by the IPv4 layer on
                        the encapsulating node or by some router along
                        the IPv4 path.
                endif
        else
                if packet is larger than (IPv4 path MTU - 20)
 result C               Send IPv6 ICMP "packet too big" with
                        MTU = (IPv4 path MTU - 20).
                        Drop packet.
                else
 result D               Encapsulate and set the Don't Fragment flag
                        in the IPv4 header.
                endif
        endif
Best regards
Hongfei Chen

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of
[email-masked]
Sent: Thursday, June 30, 2005 2:52 AM
To: [email-masked]; [email-masked]
Cc: [email-masked]
Subject: RE: a silly question

- Mukesh

-----Original Message-----

Greets,
 Jeroen

---

From: Jeroen Massar <[email-masked]>
Date: Thu, 30 Jun 2005 11:00:24 +0200

> the packet and as a originator, it can fragment the packets.

Ack, that is another way to solve this issue. The trick is that a router
does not have to do it, and really should not be doing it, but of course
it could do fragmentation if they want to do it.

Greets,
 Jeroen