TCP packet fragments over IPSEC ESP are not reassembled or forwarded
I have an IPSEC VPN between PFsense and a Cisco ASA. The ASA does fragmentation before encryption (ASA command: crypto ipsec fragmentation before-encryption outside).
In case, where I have TCP fragments in ESP packets incoming to PFSense, I can see the packets going in PFsense-WAN as ESP traffic, but the TCP fragments are not reassembled or forwarded to the LAN interface. When I have ICMP fragments in ESP packets, PFsense reassembles the full ICMP packet and forwards it to the endhost.
Is this a bug or not? There is related issue https://redmine.pfsense.org/issues/7801 which is for UDP.
Let me also tell you that "fragmentation before encryption" seems to be the default ASA behaviour (which make the problem wider).