ASA, IPSec pre-fragmentation

[isk-admin]

We have an site-to-site IPSec-VPN with an external company. This company use rdp to manage their server in our LAN. Suddenly rdp did not function. After I choose the feature IPSec Prefragmentation Policy and set the DF Bit Policy from copy to clear it works again good. What does this option do?

I think the problem started with update WINDOWS2003 MS05-19.

[#2]

Sometimes larger packets needs to be fragmented before being transmitted. DF(Dont Fragment) option in the ip packet from the client prevents this fragmentation. When you set clear DF bit, ASA automatically clear this DF bit if the size of the packet is larger than the capacity.