FAST_IPSEC not sending ICMP frag needed? (was Re: FAST_IPSEC(?) drops packets?)

[Dave Huang <khym%azeotrope.org@localhost>]

On 2/26/2011 6:36 AM, Matthias Drochner wrote:
> So is the CANTFRAG number counting in "netstat -pip"?
> Shouldn't the encapsulation code send NEEDFRAG ICMPs
> then? Do you observe any? Perhaps this part doesn't
> work correctly in FAST_IPSEC...
Yes, I do see "datagrams that can't be fragmented" increase in "netstat 
-pip". However, I don't see the router sending any ICMP fragmentation 
needed packets back.

BTW, changing net.inet.ipsec.dfbit to 0 does work around the problem 
(but causes fragmentation).