denozord/strongswan-ext
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

starter: Enable IKE fragmentation by default

Browse Source
This commit is contained in:
Tobias Brunner
2016-10-04 10:08:21 +02:00
parent 0642f42bbe
commit af662a5170
2 changed files with 6 additions and 4 deletions
Download Patch File Download Diff File Expand all files Collapse all files
man/ipsec.conf.5.in
+5 -4
View File
@@ -445,14 +445,15 @@ force UDP encapsulation for ESP packets even if no NAT situation is detected.
This may help to surmount restrictive firewalls. In order to force the peer to
encapsulate packets, NAT detection payloads are faked.
.TP
.BR fragmentation " = yes | force | " no
.BR fragmentation " = " yes " | force | no"
whether to use IKE fragmentation (proprietary IKEv1 extension or IKEv2
fragmentation as per RFC 7383). Acceptable values are
.BR yes ,
.B yes
(the default),
.B force
and
.B no
(the default). Fragmented IKE messages sent by a peer are always accepted
.BR no .
Fragmented IKE messages sent by a peer are always accepted
irrespective of the value of this option. If set to
.BR yes ,
and the peer supports it, larger IKE messages will be sent in fragments.