IPSec MTU Issue - Only from Windows 8



  • Have a FreeBSD based Host behind a pfSense 2.4.4 7100 and I have a Win 8 workstation behind a 3100 2.4.4 that was just updated a few days ago.

    They are connected with an IPSec tunnel and I can ping and SSH across the tunnel with no issues.

    The Windows Box can however not receive a Screen from Nagios and the pcap onfrom the 3100 side indicates it's a MTU size issue with the Don't Fragment Flag set.. I am also getting an error when I try and ping with a larger packet from the Windows 8 box.

    C:\Users\jms>ping 172.17.128.127 -f -l 1500

    Packet needs to be fragmented but DF set.

    I do have Enable Maximum MSS Checked and the Size set to 1400.

    0_1537982315368_a1177590-a187-4d90-8512-4930cb0721fa-image.png