Ipsec Fragmentation - HP FlexNetwork MSR Series Command Reference Manual

Related commands
ipsec global-df-bit

ipsec fragmentation

Use ipsec fragmentation to configure the IPsec fragmentation feature.
Use undo ipsec fragmentation to restore the default.
Syntax
ipsec fragmentation { after-encryption | before-encryption }
undo ipsec fragmentation
Default
The device fragments packets before IPsec encapsulation.
Views
System view
Predefined user roles
network-admin
Parameters
after-encryption: Fragments packets after IPsec encapsulation.
before-encryption: Fragments packets before IPsec encapsulation.
Usage guidelines
If you configure the device to fragment packets before IPsec encapsulation, the device
predetermines the encapsulated packet size before the actual encapsulation. If the encapsulated
packet size exceeds the MTU of the output interface, the device fragments the packets before
encapsulation. If a packet's DF bit is set, the device drops the packet and sends an ICMP error
message.
If you configure the device to fragment packets after IPsec encapsulation, the device directly
encapsulates the packets and fragments the encapsulated packets in subsequent service modules.
Examples
# Configure the device to fragment packets after IPsec encapsulation.
<Sysname>system-view
[Sysname] ipsec fragmentation after-encryption
ipsec global-df-bit
Use ipsec global-df-bit to configure the DF bit for the outer IP header of IPsec packets on all
interfaces.
Use undo ipsec global-df-bit to restore the default.
Syntax
ipsec global-df-bit { clear | copy | set }
undo ipsec global-df-bit
Default
The DF bit setting of the original IP header is copied to the outer IP header for IPsec packets.
485