H3C S6550X-HI Series Command Reference Manual page 2261

Views
System view
Predefined user roles
network-admin
Parameters
after-encryption
before-encryption
Usage guidelines
If you configure the device to fragment packets before IPsec encapsulation, the device
predetermines the encapsulated packet size before the actual encapsulation. If the encapsulated
packet size exceeds the MTU of the output interface and the DF bit is not set, the device fragments
the packet before encapsulation. If the packet's DF bit is set, the device drops the packet and sends
an ICMP error message.
If you configure the device to fragment packets after IPsec encapsulation, the device directly
encapsulates the packets and fragments the encapsulated packets in subsequent service modules.
Examples
# Configure the device to fragment packets after IPsec encapsulation.
<Sysname>system-view
[ ]
Sysname
ipsec global-df-bit
Use
ipsec global-df-bit
interfaces.
Use
undo ipsec global-df-bit
Syntax
ipsec global-df-bit { clear | copy | set }
undo ipsec global-df-bit
Default
The DF bit setting of the original IP header is copied to the outer IP header for IPsec packets.
Views
System view
Predefined user roles
network-admin
Parameters
: Clears the DF bit in the outer IP header. IPsec packets can be fragmented.
clear
: Copies the DF bit setting of the original IP header to the outer IP header.
copy
: Sets the DF bit in the outer IP header. IPsec packets cannot be fragmented.
set
Usage guidelines
This command is effective only when the IPsec encapsulation mode is tunnel mode. It is not effective
in transport mode because the outer IP header is not added in transport mode.
This command does not change the DF bit for the original IP header of IPsec packets.
: Fragments packets after IPsec encapsulation.
: Fragments packets before IPsec encapsulation.
ipsec fragmentation after-encryption
to configure the DF bit for the outer IP header of IPsec packets on all
to restore the default.
36