From 97973f860924e4472be9c842c34843cd95680642 Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 24 Dec 2012 12:28:01 +0100 Subject: Use a connection specific option to en-/disable IKEv1 fragmentation --- man/ipsec.conf.5.in | 10 ++++++++++ 1 file changed, 10 insertions(+) (limited to 'man/ipsec.conf.5.in') diff --git a/man/ipsec.conf.5.in b/man/ipsec.conf.5.in index 303fb78fa..01c7c3848 100644 --- a/man/ipsec.conf.5.in +++ b/man/ipsec.conf.5.in @@ -403,6 +403,16 @@ force UDP encapsulation for ESP packets even if no NAT situation is detected. This may help to surmount restrictive firewalls. In order to force the peer to encapsulate packets, NAT detection payloads are faked. .TP +.BR fragmentation " = yes | " no +whether to use IKE fragmentation (proprietary IKEv1 extension). Acceptable +values are +.B yes +and +.B no +(the default). Fragmented messages sent by a peer are always accepted +irrespective of the value of this option. If enabled, and the peer supports it, +larger IKE messages will be sent in fragments. +.TP .BR ike " = " comma-separated list of IKE/ISAKMP SA encryption/authentication algorithms to be used, e.g. -- cgit v1.2.3