Cisco IOS Security Configuration Guide: Secure Connectivity, Release 12.4
DF Bit Override Functionality with IPsec Tunnels
Download this chapter
DF Bit Override Functionality with IPsec TunnelsDF Bit Override Functionality with IPsec Tunnels
Download the complete book
Cisco IOS Security Configuration Guide: Secure Connectivity, Release 12.4Cisco IOS Security Configuration Guide: Secure Connectivity, Release 12.4 (PDF - 7 MB)
give_us_feedback

Table Of Contents

DF Bit Override Functionality with IPsec Tunnels

Feature Overview

Benefits

Restrictions

Related Documents

Supported Platforms

Supported Standards, MIBs, and RFCs

Prerequisites

Configuration Tasks

Configuring the DF Bit for the Encapsulating Header in Tunnel Mode

Verifying DF Bit Setting

Configuration Examples

DF Bit Setting Configuration Example

Command Reference


DF Bit Override Functionality with IPsec Tunnels

Feature History

Release
Modification

Cisco IOS

For information about feature support in Cisco IOS software, use Cisco Feature Navigator.

Cisco IOS XE Release 2.1

This feature was introduced on Cisco ASR 1000 Series Routers.


This feature module describes the DF Bit Override Functionality with IPsec Tunnels feature and contains the following sections:

•Feature Overview

•Supported Platforms

•Supported Standards, MIBs, and RFCs

•Prerequisites

•Configuration Tasks

•Configuration Examples

•Command Reference

Feature Overview

The DF Bit Override Functionality with IPsec Tunnels feature allows customers to specify whether their router can clear, set, or copy the Don't Fragment (DF) bit from the encapsulated header. A DF bit is a bit within the IP header that determines whether a router is allowed to fragment a packet.

Some customer configurations have hosts that perform the following functions:

•Set the DF bit in packets they send

•Use firewalls that block Internet Control Message Protocol (ICMP) errors from outside the firewall, preventing hosts from learning about the maximum transmission unit (MTU) size outside the firewall

•Use IP Security (IPsec) to encapsulate packets, reducing the available MTU size

Customers whose configurations have hosts that prevent them from learning about their available MTU size can configure their router to clear the DF bit and fragment the packet.

Note In compliance with RFC 2401, this feature can be configured globally or per interface. If both levels are configured, the interface configuration will override the global configuration.

Benefits

The DF Bit Override Functionality with IPsec Tunnels feature allows customers to configure the setting of the DF bit when encapsulating tunnel mode IPsec traffic on a global or per-interface level. Thus, if the DF bit is set to clear, routers can fragment packets regardless of the original DF bit setting.

Restrictions

Performance Impact

Because each packet is reassembled at the process level, a significant performance impact occurs at a high data rate. Two major caveats are as follows:

•The reassemble queue can fill up and force fragments to be dropped.

•The traffic is slower because of the process switching.

DF Bit Setting Requirement

If several interfaces share the same crypto map using the local address feature, these interfaces must share the same DF bit setting.

Feature Availability

This feature is available only for IPsec tunnel mode. (IPsec transport mode is not affected because it does not provide an encapsulating IP header.)

Related Documents

The following document provides information related to the DF Bit Override Functionality with IPsec Tunnels feature:

•Cisco IOS Security Command Reference

Supported Platforms

This feature is supported on the following platforms:

•Cisco 800

•Cisco 827

•Cisco 1600

•Cisco 1600R

•Cisco 1700

•Cisco 2600

•Cisco 3620

•Cisco 3640

•Cisco 3660

•Cisco 4000

•Cisco 4500

•Cisco 5200

•Cisco 5300

•Cisco 5400

•Cisco 6400

•Cisco 7100

•Cisco 7200

•Cisco 7500

•Cisco uBR7200

•Cisco uBR900

•Cisco uBR905

•Cisco uBR910

This feature runs on all platforms that support IPsec.

Supported Standards, MIBs, and RFCs

Standards

No new or modified standards are supported by this feature.

MIBs

No new or modified MIBS are supported by this feature.

To locate and download MIBs for selected platforms, Cisco IOS releases, and feature sets, use Cisco MIB Locator found at the following URL:

http://www.cisco.com/go/mibs

RFCs

•RFC 2401, Security Architecture for the Internet Protocol

Prerequisites

IPsec must be enabled on your router.

Configuration Tasks

See the following section for configuration tasks for the DF-Bit Override Functionality with IPsec Tunnels feature:

•Configuring the DF Bit for the Encapsulating Header in Tunnel Mode

Configuring the DF Bit for the Encapsulating Header in Tunnel Mode

To set the DF bit for the encapsulating header in tunnel mode, use the following command in global configuration mode:

Command
Purpose

Router(config)# crypto ipsec df-bit [clear | set | copy]

Sets the DF bit for the encapsulating header in tunnel mode for all interfaces.

To set the DF bit for a specified interface, use the crypto ipsec df-bit command in interface configuration mode.

Note DF bit interface configuration settings override all DF bit global configuration settings.


Verifying DF Bit Setting

To verify the current DF Bit settings on your router, use the show running-config command in EXEC mode.

Configuration Examples

This section provides the following configuration example:

•DF Bit Setting Configuration Example

DF Bit Setting Configuration Example

In following example, the router is configured to globally clear the setting for the DF bit and copy the DF bit on the interface named Ethernet0. Thus, all interfaces except Ethernet0 will allow the router to send packets larger than the available MTU size; Ethernet0 will allow the router to fragment the packet. 

crypto isakmp policy 1

   hash md5

   authentication pre-share

crypto isakmp key Delaware address 192.168.10.66

crypto isakmp key Key-What-Key address 192.168.11.19

!

!

crypto ipsec transform-set BearMama ah-md5-hmac esp-des


crypto ipsec df-bit clear

!

!

crypto map armadillo 1 ipsec-isakmp

set peer 192.168.10.66

set transform-set BearMama

match address 101

!

crypto map basilisk 1 ipsec-isakmp

set peer 192.168.11.19

set transform-set BearMama

match address 102


!

!

interface Ethernet0

   ip address 192.168.10.38 255.255.255.0

   ip broadcast-address 0.0.0.0

   media-type 10BaseT

   crypto map armadillo

   crypto ipsec df-bit copy

!

interface Ethernet1

   ip address 192.168.11.75 255.255.255.0

   ip broadcast-address 0.0.0.0

   media-type 10BaseT

   crypto map basilisk

!

interface Serial0

   no ip address

   ip broadcast-address 0.0.0.0

   no ip route-cache

   no ip mroute-cache

Command Reference

The following new commands are pertinent to this feature. To see the command pages for these commands and other commands used with this feature, go to the Cisco IOS Master Commands List at http://www.cisco.com/en/US/products/ps6441/products_product_indices_list.html.

•crypto ipsec df-bit (global configuration)

•crypto ipsec df-bit (interface configuration)

For information about these commands, see the Cisco IOS Security Command Reference at

http://www.cisco.com/en/US/docs/ios/security/command/reference/sec_book.html.

For information about all Cisco IOS commands, see the Command Lookup Tool at

http://tools.cisco.com/Support/CLILookup or the Master Command List.

CCDE, CCENT, CCSI, Cisco Eos, Cisco HealthPresence, Cisco IronPort, the Cisco logo, Cisco Lumin, Cisco Nexus, Cisco Nurse Connect, Cisco StackPower, Cisco StadiumVision, Cisco TelePresence, Cisco Unified Computing System, Cisco WebEx, DCE, Flip Channels, Flip for Good, Flip Mino, Flip Video, Flip Video (Design), Flipshare (Design), Flip Ultra, and Welcome to the Human Network are trademarks; Changing the Way We Work, Live, Play, and Learn, Cisco Store, and Flip Gift Card are service marks; and Access Registrar, Aironet, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Collaboration Without Limitation, EtherFast, EtherSwitch, Event Center, Fast Step, Follow Me Browsing, FormShare, GigaDrive, HomeLink, Internet Quotient, IOS, iPhone, iQuick Study, IronPort, the IronPort logo, LightStream, Linksys, MediaTone, MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking Academy, Network Registrar, PCNow, PIX, PowerPanels, ProConnect, ScriptShare, SenderBase, SMARTnet, Spectrum Expert, StackWise, The Fastest Way to Increase Your Internet Quotient, TransPath, WebEx, and the WebEx logo are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.

All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0907R)


Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.

© 2007 Cisco Systems, Inc. All rights reserved.