I have a Linux IPSec Tunnel between a GGSN of a network operator and our data center. The IPSec works fine for all traffic but IP Packets coming from our side and are marked with ECN bit set to 0x3 (CE, Congestion experianced) will not encrypted and forwarded to the tunnel.
The Tunnel is setup without ECN support, but for my understanding this should not lead to a packet drop.
Linux Kernel Version is 2.6.18-6-xen-amd64 #1 SMP Fri Dec 12 07:02:03 UTC 2008 x86_64 GNU/Linux (quite old but the xen infrastructure does not allow newer kernels)
Keying Daemon is racoon 0.7.3
Any hints how to overcome this problem?