I tried to solve problem with fragmentation and configured parameters as below. The same is on the router on the other side.
ip mtu 1438
I configured GRE over IPSEC (transport mode), and problem is PMTUD. It seem to be broken. I don't have firewall between router. Ping to other side with large packet and set DF bit is unsuccesful. With sniffer I saw one ICMP request sent and received ICMP unreachable packet but subsequent ping packets is again unsuccesful and ping packets was not seeing with sniffer.
The reason is that even if Windows see the "ICMP unreachable" it will not change its ping size. The ping was set to be sent with big payload and Windows will keep sending it that way, causing it to fail.
The unreachable is sent to alert the client so it sends smaller packets. In case this was TCP then the Windows device should changes it MSS and send smaller payloads.
Table of ContentsIntroductionVersion HistoryPossible Future
UpdatesDocuments PurposeNAT Operation in ASA 8.3+ SectionsRule Types
Network Object NATTwice NAT / Manual NATRule Types used per SectionNAT
Types used with Twice NAT / Manual NAT and Network Obje...
[toc:faq]Introduction:This document describes details on how NAT-T
works.Background:ESP encrypts all critical information, encapsulating
the entire inner TCP/UDP datagram within an ESP header. ESP is an IP
protocol in the same sense that TCP and UDP are I...