When you design a network that uses IPsec, where can you reduce MTU to avoid network fragmentation?

TCP MSS clamping or MTU reduction must be applied on both ends of the TCP connection so that both the initiating host and the responding server generate segments small enough to fit within the reduced effective MTU after IPsec ESP/AH headers are added, preventing fragmentation in either direction of the flow.

Reducing MTU only on the client side prevents oversized segments from the client but does not constrain the server from sending large segments toward the client, which will still be fragmented as they traverse the IPsec tunnel.

Reducing MTU only on the server side prevents oversized segments from the server but leaves the client free to send large segments that will be fragmented when entering the IPsec tunnel in the outbound direction.

Lowering MTU in the WAN does not propagate TCP MSS information back to the endpoints; without endpoint adjustment, TCP sessions negotiate a larger MSS than the tunnel can carry, and fragmentation still occurs at the tunnel ingress.