H3C S6550X-HI Series Command Reference Manual page 2280

: Copies the DF bit setting of the original IP header to the outer IP header.
copy
: Sets the DF bit in the outer IP header. IPsec packets cannot be fragmented.
set
Usage guidelines
This command is effective only when the IPsec encapsulation mode is tunnel mode. It is not effective
in transport mode because the outer IP header is not added in transport mode.
This command is supported only when the IKE negotiation mode is used for IPsec SA setup.
This command does not change the DF bit for the original IP header of IPsec packets.
Packet fragmentation and reassembly might cause packet forwarding to be delayed. You can set the
DF bit to avoid the forwarding delay. If the DF bit is set, make sure the path MTU is larger than the
IPsec packet size to prevent the IPsec packets from being discarded. Clear the DF bit if you cannot
make sure the path MTU is larger than the IPsec packet size.
If the DF bit setting is not configured in the IPsec policy, IPsec profile, or IPsec policy template, the
interface-specific DF bit setting is used. If the interface-specific DF bit setting is not configured either,
the global DF bit setting is used.
Examples
# Set the DF bit in the outer IP header of IPsec packets in IPsec policy policy1.
<Sysname> system-view
[ ]
Sysname
[
Sysname-ipsec-policy-isakmp-policy1-100
Related commands
ipsec df-bit
ipsec global-df-bit
sa duration
Use
sa duration
Use
undo sa duration
Syntax
sa duration { time-based seconds | traffic-based kilobytes }
undo sa duration { time-based | traffic-based }
Default
The SA lifetime of an IPsec policy, IPsec profile, or IPsec policy template is the current global SA
lifetime.
Views
IPsec policy view
IPsec policy template view
IPsec profile view
Predefined user roles
network-admin
Parameters
time-based seconds
seconds.
ipsec policy policy1 100 isakmp
to set an SA lifetime.
to remove an SA lifetime.
: Specifies the time-based SA lifetime in the range of 180 to 604800
]
sa df-bit set
55