Junos IPSEC Tunnel to Azure & TCP-MSS

I am configuring a Juniper SRX 300 Series to establish an IPSEC tunnel to Azure.

The Azure Vnet range is 192.168.10.0/23

The local range is 10.49.236.0/24.

The configuration: (relevant bits with sensitive parts replaced with $PART)

​security {
    ike {
        proposal ike-proposal-azure {
            authentication-method pre-shared-keys;
            dh-group group2;
            authentication-algorithm sha1;
            encryption-algorithm aes-256-cbc;
            lifetime-seconds 28800;
        }
        policy ike-policy-azure {
            mode main;
            proposals ike-proposal-azure;
            pre-shared-key ascii-text "$PSK";
        }
        gateway ike-gate-azure {
            ike-policy ike-policy-azure;
            address $AZUREGWPUBLICIP
            external-interface ge-0/0/0.0;
            version v2-only;
        }
    }
    ipsec {
        vpn-monitor-options {
            interval 10;
            threshold 10;
        }
        proposal ipsec-proposal-azure {
            protocol esp;
            authentication-algorithm hmac-sha1-96;
            encryption-algorithm 3des-cbc;
            lifetime-seconds 27000;
        }
        policy ipsec-policy-azure {
            proposals ipsec-proposal-azure;
        }
        vpn ipsec-vpn-azure {
            bind-interface st0.0;
            vpn-monitor {
                optimized;
            }
            ike {
                gateway ike-gate-azure;
                ipsec-policy ipsec-policy-azure;
            }
            establish-tunnels immediately;
        }
    }
    flow {
        tcp-mss {
            all-tcp {
                mss 1350;
            }
            ipsec-vpn {
                mss 1350;
            }
        }
    }

​
There are also security rules/policies to allow traffic to/from the vpn and a route for 192,168.10.0/23 pointing to st0.0.
​
The Problem:

PS C:\windows\system32> ping -l 1500 192.168.10.20

Pinging 192.168.10.20 with 1500 bytes of data:
Request timed out.
Request timed out.
Request timed out.
Request timed out.

Ping statistics for 192.168.10.20:
    Packets: Sent = 4 Received = 0, Lost = 4 (100% loss),
Control-C
PS C:\windows\system32> ping -l 1400 192.168.10.20

Pinging 192.168.10.20 with 1400 bytes of data:
Reply from 192.168.10.20: bytes=1400 time=8ms TTL=127
Reply from 192.168.10.20: bytes=1400 time=7ms TTL=127

Ping statistics for 192.168.10.20:
    Packets: Sent = 2, Received = 2, Lost = 0 (0% loss),
Approximate round trip times in milli-seconds:
    Minimum = 7ms, Maximum = 8ms, Average = 7ms

SMB traffic to Azure hosts is also affected.
​
When running wireshark on the azure host I see a bunch of fragments and fragment reassembly time exceeded.
https://i.imgur.com/3c2c6uE.png
​