Drop Code: 435(Packet received in IPv6 and large than MTU(#1)), Module Id: 20(IPsec)

Per RFC2460, routers will not perform fragmentation for transit ipv6 traffic. Fragmentation is performed only by the source node once the fragmentation boundary condition is learned via ICMPv6 Packet Too Big Messages. So an IOS router acting as an IPsec end point will not perform fragmentation for traffic going into the tunnel, therefore the IPsec pre-fragmentation feature simply does not apply for IPv6. 

Also for PMTUD need to allow icmp packets type 2, since by default we deny icmp packets on WAN interfaces it will not be performed to avoid fragmentation.