IPSec tunnels are encapsulated so the packets have a additional data on each packet (20-60 bytes or so, at least) that makes them big. A Cisco ASA firewall sets all TCP connections to MSS 1380 to ...

I am using a strongSwan IPSec gateway for Windows 7 and Server 2008 based clients on the same subnet. The Windows VPN client requires a virtual ip address to be assigned by the IPsec gateway.