From af662a5170d919aedc4144a0462debd9155a800d Mon Sep 17 00:00:00 2001 From: Tobias Brunner Date: Mon, 18 Jul 2016 15:25:45 +0200 Subject: starter: Enable IKE fragmentation by default --- man/ipsec.conf.5.in | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) (limited to 'man/ipsec.conf.5.in') diff --git a/man/ipsec.conf.5.in b/man/ipsec.conf.5.in index 6d99e13f9..6f80709a6 100644 --- a/man/ipsec.conf.5.in +++ b/man/ipsec.conf.5.in @@ -445,14 +445,15 @@ force UDP encapsulation for ESP packets even if no NAT situation is detected. This may help to surmount restrictive firewalls. In order to force the peer to encapsulate packets, NAT detection payloads are faked. .TP -.BR fragmentation " = yes | force | " no +.BR fragmentation " = " yes " | force | no" whether to use IKE fragmentation (proprietary IKEv1 extension or IKEv2 fragmentation as per RFC 7383). Acceptable values are -.BR yes , +.B yes +(the default), .B force and -.B no -(the default). Fragmented IKE messages sent by a peer are always accepted +.BR no . +Fragmented IKE messages sent by a peer are always accepted irrespective of the value of this option. If set to .BR yes , and the peer supports it, larger IKE messages will be sent in fragments. -- cgit v1.2.3