title: Why doesn't Linux IPSec implementation support fragmentation before encryption?
body: <p>I am trying to address an issue where ESP packets are getting fragmented as after adding the ESP header the MTU size is exceeded. The solution (which is what everybody does) is to do the fragmentation before doing the ESP encryption.</p>
  
  <p>My question is if this is so useful, why doesn't the Linux IPSec implementation natively support it. I understand there would be certain limitations that L4 traffic selectors would not work. But not everybody makes use of it.</p>
  
  <p>In addition, if you can share any pointers as to what's the best way to add this support, it would really help.</p>
  
  <p>Thanks.</p>