H3C S6550X-HI Series Command Reference Manual page 2260

Syntax
ipsec df-bit { clear | copy | set }
undo ipsec df-bit
Default
The DF bit is not configured for the outer IP header of IPsec packets on an interface. The global DF
bit setting is used.
Views
Interface view
Predefined user roles
network-admin
Parameters
: Clears the DF bit in the outer IP header. IPsec packets can be fragmented.
clear
: Copies the DF bit setting of the original IP header to the outer IP header.
copy
: Sets the DF bit in the outer IP header. IPsec packets cannot be fragmented.
set
Usage guidelines
This command is effective only when the IPsec encapsulation mode is tunnel mode. It is not effective
in transport mode because the outer IP header is not added in transport mode.
This command does not change the DF bit for the original IP header of IPsec packets.
If multiple interfaces use an IPsec policy that is bound to a source interface, you must use the same
DF bit setting on these interfaces.
Packet fragmentation and reassembly might cause packet forwarding to be delayed. You can set the
DF bit to avoid the forwarding delay. However, to prevent the IPsec packets from being discarded,
you must make sure the path MTU is larger than the IPsec packet size. As a best practice, clear the
DF bit if you cannot make sure the path MTU is larger than the IPsec packet size.
Examples
# Set the DF bit in the outer IP header of IPsec packets on VLAN-interface100.
<Sysname> system-view
[Sysname] interface vlan-interface 100
[Sysname–Vlan-interface100] ipsec df-bit set
Related commands
ipsec global-df-bit
ipsec fragmentation
Use
ipsec fragmentation
Use
undo ipsec fragmentation
Syntax
ipsec fragmentation { after-encryption | before-encryption }
undo ipsec fragmentation
Default
The device fragments packets before IPsec encapsulation.
to configure the IPsec fragmentation feature.
to restore the default.
35