I'm not sure where else to go with this one..... We're testing the EHWIC-4G-LTE-VZ card with a 2901 router in our lab. We had a flexvpn setup over Verizon to an ASR1000 on the other end. Nothing fancy : crypto ikev2 client flexvpn EnventisFlex peer 1 x.x.x.x client connect Tunnel1 interface Cellular0/2/0 description IPSec Failver 3rd Party Circuit vrf forwarding ipsecOutside ip address negotiated encapsulation slip dialer in-band dialer idle-timeout 5 dialer enable-timeout 10 dialer string lte dialer watch-group 1 end interface Tunnel1 description Connection to 511/EDC ip unnumbered Loopback50 ip mtu 1400 ip pim sparse-mode ip tcp adjust-mss 1360 tunnel source Cellular0/2/0 tunnel destination dynamic tunnel path-mtu-discovery tunnel vrf ipsecOutside tunnel protection ipsec profile EnventisIPSecProfile end This was working for a while, then suddenly it stopped working and the IKE exchange between the two wouldn't complete. So I started digging and did a few packet captures on both sides. From the ASR 1000 side, pcap looks like this : 2901 SA_INIT >  A1K (port 500, 500 bytes) A1K SA_INIT > 2901 (port 500, 500 bytes) 2901 IKE_AUTH > A1K (port 4500, 2000 bytes w/ fragments) A1K IKE_AUTH > 2901 (port 4500, 2000 bytes w/ fragments ) 2901 IKE_AUTH > A1K (port 4500, 2000 bytes w/ fragments) A1K IKE_AUTH > 2901 (port 4500, 2000 bytes w/ fragments ) 2901 IKE_AUTH > A1K (port 4500, 2000 bytes w/ fragments) A1K IKE_AUTH > 2901 (port 4500, 2000 bytes w/ fragments ) 2901 IKE_AUTH > A1K (port 4500, 2000 bytes w/ fragments) A1K IKE_AUTH > 2901 (port 4500, 2000 bytes w/ fragments ) The 2901 never receives the IKE_AUTH response from the ASR 1000 so both ends just keep retransmitting. Ok....why not? MTU issue? So I start some pings from the 2901 over the Cellular connection : ! Ping msnbc Router# ping vrf ipsecOutside 23.222.203.175 size 1500 Type escape sequence to abort. Sending 5, 1500-byte ICMP Echos to 23.222.203.175, timeout is 2 seconds: ..... 5 minute output rate 0 bits/sec, 0 packets/sec 0 packets input, 0 bytes, 0 no buffer Received 0 broadcasts (0 IP multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 5 packets output, 7500 bytes, 0 underruns Router# clear counters cell 0/2/0 Clear "show interface" counters on this interface [confirm] Cellular0/2/0 QoS statistics data clear currently is not supported. Router# ping vrf ipsecOutside 23.222.203.175 size 1444 Type escape sequence to abort. Sending 5, 1444-byte ICMP Echos to 23.222.203.175, timeout is 2 seconds: !!!!! 5 minute output rate 1000 bits/sec, 1 packets/sec 5 packets input, 7220 bytes, 0 no buffer Received 0 broadcasts (0 IP multicasts) 0 runts, 0 giants, 0 throttles 0 input errors, 0 CRC, 0 frame, 0 overrun, 0 ignored, 0 abort 5 packets output, 7220 bytes, 0 underruns Router# ping vrf ipsecOutside 23.222.203.175 size 1445 Type escape sequence to abort. Sending 5, 1500-byte ICMP Echos to 23.222.203.175, timeout is 2 seconds: ..... um ok, so : Router# ping vrf ipsecOutside 8.8.8.8 size 1500 Type escape sequence to abort. Sending 5, 1500-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds: !!!!! Success rate is 100 percent (5/5), round-trip min/avg/max = 136/141/144 ms Router#  ping vrf ipsecOutside 8.8.8.8 size 1500 df-bit Type escape sequence to abort. Sending 5, 1500-byte ICMP Echos to 8.8.8.8, timeout is 2 seconds: Packet sent with the DF bit set !!!!! Seriously, WTF is happening!? Verizon likely uses some funky CGN, but as long as we get ICMP unreachables for the dropped packets, PMTUD would probably work. But unfortunately when performing packet captures on remote nodes, I do not receive any such responses to dropped packets. What am I missing something here? How would I go about getting IPSEC to work over this connection with this kind of NAT behavior from the carrier? ... View more