With Debian bookworm, the PQC KE sntrup761x25519-sha512 is negotiated, by default. This increases the overhead significantly, in particular, the size of the KE message, which wouldn't get through IPsec tunnels without MSS clamping.
With Debian bookworm, the PQC KE sntrup761x25519-sha512 is negotiated, by default. This increases the overhead significantly, in particular, the size of the KE message, which wouldn't get through IPsec tunnels without MSS clamping.