When Windows IKEv2 Meets Fragment-Dropping Networks

IKEv2 is a clean and efficient VPN protocol, but its reliance on large messages during authentication can cause surprising failures when it crosses access networks that mishandle fragments. Administrators running WatchGuard firewalls and Windows clients have been reporting problems where connections succeed on one ISP but fail completely on another.