When designing a network that uses IPsec, which technique is suggested to avoid network fragmentation?

Reducing the MTU only on the server side leaves client-originated segments potentially oversized after IPsec encapsulation, causing fragmentation for traffic in that direction.

IPsec adds significant overhead through ESP or AH headers, initialization vectors, and padding, which reduces the effective MTU of the path. Reducing the MTU symmetrically on both ends of the TCP connection ensures that neither endpoint sends segments that exceed the tunnel's effective MTU, preventing fragmentation in both traffic directions. This is often achieved via TCP MSS clamping combined with MTU reduction at both endpoints.

Reducing the MTU only on the client side leaves server-originated traffic susceptible to fragmentation after IPsec overhead is applied.

Reducing the MTU only on the WAN segment does not address fragmentation that originates at either endpoint before packets reach the WAN, leaving both sides able to send oversized frames.