Strange NFS lockup through IPsec

[Edgar Fuß <efnbl07%bn2.maus.net@localhost>]

We're experiencing strange NFS lockups. These only happen from time to time,
and they only happen to a few clients conneted to the NFS server in question
via an IPsec tunnel.

Clients are Linux (2.6) boxes, server is NetBSD 4.0/amd64. NFS runs through TCP.

Sometimes NFS on one of the clients gets stuck. There seems to be no way out
of this other than rebooting the client. All other clients continue to
function normally.

In the stuck state, the server receives an NFS request, acknowledges it
(TCP-wise, I mean), but fails to answer. There's a TCP window, the Send-Q
fills up, but nothing gets sent.

Eventually, the NFS RPC gets retransmitted, gets ACK'ed again, but remains
unanswered (on the wire) while the Send-Q fills.

Why on earth would the TCP stack refuse to send if there's a route (otherwise
the TCP ACK's wouldn't be sent), there's a window and there's data in the queue?

There can't be anything grossly wrong with the server because there're quite
a number of other clients working normally. Even in the stuck state, I see
UDP NFS Null Calls/Replies to the stuck client. Just TCP hangs.

Strange, isn't it?