Configuring Ip Virtual Fragment Reassembly; Configuration Guidelines; Configuration Procedure; Configuration Example - H3C MSR 2600 Configuration Manual

Configuring IP virtual fragment reassembly

To make sure fragments arrive at a service module in order, the IP virtual fragment reassembly feature
virtually reassembles the fragments of a datagram through sequencing and caching. The IP virtual
fragment reassembly feature also prevents some service modules (such as IPsec, NAT, and firewall) from
processing packet fragments that do not arrive in order.
For security purposes, the IP virtual fragment reassembly feature can detect the following types of
fragment attacks, and discard the attack fragments:
Tiny fragment attack—If the first fragment of an incoming datagram is smaller than the Layer 4
•
(such as TCP and UDP) header and the Layer 4 header is placed into the second fragment, a tiny
fragment attack occurs.
• Overlapping fragment attack—If two consecutive incoming fragments are identical or overlap
each other, an overlapping fragment attack occurs.
Buffer overflow attack—If the number of concurrent reassemblies or the number of fragments per
•
datagram exceeds the upper limits, a buffer overflow attack occurs.

Configuration guidelines

The IP virtual fragment reassembly feature only applies to incoming packets on an interface.
•
The IP virtual fragment reassembly feature does not support load sharing. The fragments of an IP
•
datagram cannot arrive through different interfaces.

Configuration procedure

To configure IP virtual fragment reassembly:
Step
1. Enter system view.
2. Enter interface view.
3. Enable IP virtual fragment
reassembly.

Configuration example

Network requirements
As shown in
Router A connects to Host and Router B.
•
NAT is enabled on Ethernet 1/2 of Router A.
•
• Configure IP virtual fragment reassembly on Ethernet 1/2 of Router A.
Command
system-view
interface interface-type interface-number
ip virtual-reassembly [ drop-fragments |
max-fragments number | max-reassemblies
number | timeout seconds ] *
Figure 65, configure devices as follows:
168
Remarks
N/A
N/A
By default, the feature is
disabled.