[elided] 
> If my memory serves me right, then this started happening as soon as I
> upgraded the client (10.1.1.1) from 1.5ZC to 1.6A, even though the
> problems *seem* to be at the server end (which first stayed at 1.5ZC
> and was then upgraded to 1.6A, 1.6B and 1.6D without any help).
> 
> It would seem that as soon as I turn IPSEC policy on for the
> client/server pair, I start loosing packets (from the server end).
> Why did it surface after (client?) upgrade to 1.6A (and beyond)? Have I
> overlooked a required change somewhere along the way?
[elided] 
> This is what the ep0 interface looks like on server (modified MAC,inet,inet6):
> -------------------------------------------------------------------
> ep0: flags=8963<UP,BROADCAST,NOTRAILERS,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500

You may want to check the recent threads on current-users: "pcmcia
ep0 performance awful in 1.6", "Very slow pipe/TCP connection in 1.6", and
"Strange NFS-client bug".

There's been a lot of discussion as to whether the ep0 driver is just
really awful or hasn't enough buffer space, but the same things seem
to happen in 10Mb media in general - not just ep.