Hello Chris, For ethernet interface, the Max MTU size is 1500 bytes. The ESP protocol header will be placed in the top of the IP header. IP header would be 20 Bytes, hence the original data+ EST header size can be max (1500-20)=1480 Bytes. ESP header can be 52 bytes, including below mentioned option field: --------------------------------- ESP header -------------------------------- Security Parameters Index =(32 bits) Arbitrary value used (together with the destination IP address) to identify the security association of the receiving party. Sequence Number (32 bits) =A monotonically increasing sequence number (incremented by 1 for every packet sent) to protect against replay attacks. There is a separate counter kept for every security association. Padding (0-255 octets)= Padding for encryption, to extend the payload data to a size that fits the encryption's cipher block size, and to align the next field. Payload data (variable) =The protected contents of the original IP packet, including any data used to protect the contents (e.g. an Initialisation Vector for the cryptographic algorithm). The type of content that was protected is indicated by the Next Header field.=Size of the padding (in octets). Next Header (8 bits) =Type of the next header. The value is taken from the list of IP protocol numbers. Integrity Check Value (multiple of 32 bits) =Variable length check value. It may contain padding to align the field to an 8-octet boundary for IPv6, or a 4-octet boundary for IPv4. Payload data (variable, max 6 byte) =The protected contents of the original IP packet, including any data used to protect the contents (e.g. an Initialisation Vector for the cryptographic algorithm). The type of content that was protected is indicated by the Next Header field. So, the actual data can pass through the tunnel without fragmentation will be (1480-52)=1428 Bytes. The tunnel MTU would not depend on encryption parameter. Because, encryption parameter will be identified by SPI (Security parameter index-to identify the security association SA ) Path MTU is not being calculated, and any packet more than 1500 Bytes on an ethernet interface will be fragmented Thanks
... View more
.png "Satish"){kind=avatar}
