> I'd recommend turning the MTU down on interfaces heading towards an
 > IPSEC tunnel to 1450 or so from 1500.

Thanks, that solved the problem!  The fragments were getting blocked
somewhere.  (I haven't figured out where, there are packet filters and
IPSEC in between.)

/Marcus