Firewall/NAT

Internet searches have been fruitless, so time to ask for help! I'll try to lay out as many details as I can, but please let me know if anyone wants additional information.

I use Cisco's AnyConnect to VPN to work from my local network behind a M0n0wall firewall. When I VPN and then access the remote network (websites, SVN updates, etc.), m0n0wall records a large number of fragmented packets being blocked on the WAN interface, and I believe this is the reason my connection over VPN is excruciatingly slow.

Here are a few lines from the logs, with IP addresses removed (VPN.Server.IP is recorded in my logs as the IP address of the server I VPN to, and Local.DSL.IP is the address my DSL modem is using):

21:53:34.638328 ng0 @200:3 b VPN.Server.IP -> Local.DSL.IP PR udp len 20 (25) (frag 40900:5@1472) K-S K-F IN
21:53:33.874547 ng0 @200:3 b VPN.Server.IP -> Local.DSL.IP PR udp len 20 (25) (frag 59478:5@1472) K-S K-F IN
21:53:29.163169 ng0 @200:3 b VPN.Server.IP -> Local.DSL.IP PR udp len 20 (25) (frag 36850:5@1472) K-S K-F IN
21:53:26.706782 ng0 @200:3 b VPN.Server.IP -> Local.DSL.IP PR udp len 20 (25) (frag 57090:5@1472) K-S K-F IN

So far, I've attempted:
1) Adding a rule to WAN that says to allow UDP traffic from VPN.Server.IP to Local.DSL.IP, and to allow fragmented packets, and to log packets handled by this rule, but it doesn't change the blocking of the fragmented packets coming in. (The default LAN rule is configured to allow fragmented packets).
2) Adjusting the MTU on the WAN interface (using PPPoE with the DSL modem) to 1375, which is the next round number down from 1379, which is where ping packets stopped fragmenting (ping -f -l 1379 remote_server) when VPN'ed and able to access the remote network.

Anyone have any ideas what might be needed to get the fragmentation to stop? VPN has the same slowness issues on any machine in my house, but works great from other networks.

Thanks!

It sounds like and MTU problem.  You M0n0wall is connected via DSL and running pppoe, so your packet size is alread reduced from the normal 1500 because of the pppoe overhead.

VPN gives an additional overhead, the size of which depends on the type of VPN, cisco will usually be IPSEC in tunnel mode, so you have the overhead of a new set of headers, and also cisco VPN's have the option of using udp or tcp to wrap the VPN connection to make it NAT friendly.  Or there is SSL VPN ....

Depending on your setup, the client will negotiate MTU with the Cisco ATA / Router / Firewall, and this setting is configurable on the ASDM.  Again, depending on your setup, the client will take your client MTU (1500) and reduce it by 94 Bytes and propose that as the MTU.  If this is what is happening to you, the best option is to reduce the MTU on the ASDM in your HQ, or reduce the MTU on your client PC, look at tcpoptimizer.exe http://www.speedguide.net/downloads.php if it's windows