Cisco IOS Security Configuration Guide: Secure Connectivity, Release 12.4T
Pre-Fragmentation for IPsec VPNs
Download this chapter
Pre-Fragmentation for IPsec VPNsPre-Fragmentation for IPsec VPNs
Download the complete book
Cisco IOS Security Configuration Guide: Secure Connectivity, Release 12.4TCisco IOS Security Configuration Guide: Secure Connectivity, Release 12.4T (PDF - 8 MB)
give_us_feedback

Table Of Contents

Pre-Fragmentation for IPsec VPNs

Feature Overview

Benefits

Restrictions

Supported Platforms

Supported Standards, MIBs, and RFCs

Configuration Tasks

Configuring Pre-Fragmentation For IPsec VPNs

Verifying Pre-Fragmentation For IPsec VPNs

Configuration Examples

Enabling Pre-Fragmentation For IPsec VPNs Example

Command Reference


Pre-Fragmentation for IPsec VPNs

Feature History

Release
Modification

12.1(11b)E

This feature was introduced.

12.2(13)T

This feature was integrated into Cisco IOS Release 12.2(13)T.

12.2(14)S

This feature was integrated into Cisco IOS Release 12.2(14)S.

Cisco IOS XE Release 2.1

This feature was introduced on Cisco ASR 1000 Series Routers.


This feature module describes the Pre-fragmentation for IPsec VPNs feature in Cisco IOS Release 12.2(13)T and 12.2(14)S. It includes the following sections:

•Feature Overview

•Supported Platforms

•Supported Standards, MIBs, and RFCs

•Configuration Tasks

•Configuration Examples

•Command Reference

Feature Overview

When a packet is nearly the size of the maximum transmission unit (MTU) of the outbound link of the encrypting router, and it is encapsulated with IPsec headers, it is likely to exceed the MTU of the outbound link. This causes packet fragmentation after encryption, which makes the decrypting router reassemble in the process path. Pre-fragmentation for IPsec VPNs increases the decrypting router's performance by enabling it to operate in the high performance CEF path instead of the process path.

This feature allows an encrypting router to predetermine the encapsulated packet size from information available in transform sets, which are configured as part of the IPsec security association (SA). If it is predetermined that the packet will exceed the MTU of the output interface, the packet is fragmented before encryption. This function avoids process level reassembly before decryption and helps improve decryption performance and overall IPsec traffic throughput.

Note The pre-fragmentation feature is turned off by default for tunnel interfaces. To receive pre-fragmentation performance benefits, turn pre-fragmentation on after insuring that the tunnel interfaces have the same MTU on both ends.

Benefits

Increased Performance

Delivers encryption throughput at maximum encryption hardware accelerator speeds. This performance increase is for near MTU-sized packets.

Uniform Fragmentation

Packets are fragmented into equally sized units to prevent further downstream fragmentation.

Interoperability

This feature is interoperable with all Cisco IOS platforms and a number of Cisco VPN clients.

Restrictions

Take the following information into consideration before this feature is configured:

•Pre-fragmentation for IPsec VPNs operates in IPsec tunnel mode and IPsec tunnel mode with GRE, but not with IPsec transport mode.

•Pre-fragmentation for IPsec VPNs configured on the decrypting router in a unidirectional traffic scenario does not improve the performance or change the behavior of either of the peers.

•Pre-fragmentation for IPsec VPNs occurs before the transform is applied if compression is turned on for outgoing packets.

•Pre-fragmentation for IPsec VPNs functionality depends on the egress interface crypto ipsec df-bit configuration and the incoming packet "do not fragment" (DF) bit state. See Table 1.

Table 1 Pre-Fragmentation for IPsec VPNs Dependencies 

Pre-Fragmentation for IPsec VPNs Feature State (Enabled/Disabled)
Egress Interface "crypto ipsec df-bit" Configuration
Incoming Packet DF Bit State
Result

Enabled

crypto ipsec df-bit clear

0

Fragmentation occurs before encryption.

Enabled

crypto ipsec df-bit clear

1

Fragmentation occurs before encryption.

Disabled

crypto ipsec df-bit clear

0

Fragmentation occurs after encryption and packets are reassembled before decryption.

Disabled

crypto ipsec df-bit clear

1

Fragmentation occurs after encryption and packets are reassembled before decryption.

Enabled

crypto ipsec df-bit set

0

Fragmentation occurs before encryption.

Enabled

crypto ipsec df-bit set

1

Packets are dropped.

Disabled

crypto ipsec df-bit set

0

Fragmentation occurs after encryption and packets are reassembled before decryption.

Disabled

crypto ipsec df-bit set

1

Packets are dropped.

Enabled

crypto ipsec df-bit copy

0

Fragmentation occurs before encryption.

Enabled

crypto ipsec df-bit copy

1

Packets are dropped.

Disabled

crypto ipsec df-bit copy

0

Fragmentation occurs after encryption and packets are reassembled before decryption.

Disabled

crypto ipsec df-bit copy

1

Packets are dropped.


Supported Platforms

12.2(14)S and higher

The Pre-fragmentation for IPsec VPN feature is supported on the following platforms:

•Cisco 7200 series

•Cisco 7400 series

12.2(13)T

The Pre-fragmentation for IPsec VPN feature is supported on all platforms using Cisco IOS Release 12.2(13)T or higher, including:

•Cisco 1710

•Cisco 1720

•Cisco 1721

•Cisco 1751

•Cisco 1760

•Cisco 2600

•Cisco 2691

•Cisco 3620

•Cisco 3640

•Cisco 3660

•Cisco 3725

•Cisco 3745

•Cisco 7100 series

•Cisco 7200 series

•Cisco 7400 series

12.1(11b)E

The Pre-fragmentation for IPsec VPN feature is supported on all platforms using Cisco IOS Release 12.1(11b)E or higher, including:

•Cisco 7100 series

Determining Platform Support Through Cisco Feature Navigator

Cisco IOS software is packaged in feature sets that are supported on specific platforms. To get updated information regarding platform support for this feature, access Cisco Feature Navigator. Cisco Feature Navigator dynamically updates the list of supported platforms as new platform support is added for the feature.

Cisco Feature Navigator is a web-based tool that enables you to determine which Cisco IOS software images support a specific set of features and which features are supported in a specific Cisco IOS image. You can search by feature or release. Under the release section, you can compare releases side by side to display both the features unique to each software release and the features in common.

To access Cisco Feature Navigator, you must have an account on Cisco.com. If you have forgotten or lost your account information, send a blank e-mail to cco-locksmith@cisco.com. An automatic check will verify that your e-mail address is registered with Cisco.com. If the check is successful, account details with a new random password will be e-mailed to you. Qualified users can establish an account on Cisco.com by following the directions found at this URL:

http://www.cisco.com/register

Cisco Feature Navigator is updated regularly when major Cisco IOS software releases and technology releases occur. For the most current information, go to the Cisco Feature Navigator home page at the following URL:

http://tools.cisco.com/ITDIT/CFN/jsp/index.jsp

Availability of Cisco IOS Software Images

Platform support for particular Cisco IOS software releases is dependent on the availability of the software images for those platforms. Software images for some platforms may be deferred, delayed, or changed without prior notice. For updated information about platform support and availability of software images for each Cisco IOS software release, refer to the online release notes or, if supported, Cisco Feature Navigator.

Supported Standards, MIBs, and RFCs

Standards

•No new or modified standards are supported by this feature.

MIBs

•No new or modified standards are supported by this feature.

To locate and download MIBs for selected platforms, Cisco IOS software releases, and feature sets, use Cisco MIB Locator found at the following URL:

http://www.cisco.com/go/mibs

RFCs

•No new or modified RFCs are supported by this feature.

Configuration Tasks

See the following sections for configuration tasks for the Pre-fragmentation for IPsec VPNs feature. Each task in the list is identified as either required or optional.

•Configuring Pre-Fragmentation For IPsec VPNs (required)

•Verifying Pre-Fragmentation For IPsec VPNs (optional)

Configuring Pre-Fragmentation For IPsec VPNs

Pre-fragmentation for IPsec VPNs is globally enabled by default. To enable or disable pre-fragmentation for IPsec VPNs while in interface configuration mode, enter the commands in the following table. Use the no form of the commands to revert back to the default configuration, or use the commands themselves to enable configuration of the pre-fragmentation IPsec VPNs.

Note Manually enabling or disabling this feature will override the global configuration.

Command
Purpose

Router(config-if)# crypto ipsec fragmentation before-encryption

Enables pre-fragmentation for IPsec VPNs on the interface.

Router(config-if)# crypto ipsec fragmentation after-encryption

Disables pre-fragmentation for IPsec VPNs on the interface.

Router(config)# crypto ipsec fragmentation before-encryption

Enables pre-fragmentation for IPsec VPNs globally.

Router(config)# crypto ipsec fragmentation after-encryption

Disables pre-fragmentation for IPsec VPNs globally.


Verifying Pre-Fragmentation For IPsec VPNs

To verify that this feature is enabled, consult the interface statistics on the encrypting router and the decrypting router. If fragmentation occurs on the encrypting router, and no reassembly occurs on the decrypting router, fragmentation is happening before encryption, and thus the packets are not being reassembled before decryption. This means that the feature is enabled.

Note This method of verification does not apply to packets destined for the decrypting router.

Step 1 Enter the show running-configuration command on the encrypting router. If the feature is enabled, you will observe output similar to the following: 

Router# show running-configuration

crypto isakmp policy 10

 authentication pre-share

crypto isakmp key abcd123 address 25.0.0.7

!

!

crypto ipsec transform-set fooprime esp-3des esp-sha-hmac

!

crypto map bar 10 ipsec-isakmp

 set peer 25.0.0.7

 set transform-set fooprime

 match address 102

If the feature has been disabled, you will observe output similar to the following: 

Router# show running-configuration

crypto isakmp policy 10

 authentication pre-share

crypto isakmp key abcd123 address 25.0.0.7

!

!

crypto ipsec transform-set fooprime esp-3des esp-sha-hmac

crypto ipsec fragmentation after-encryption

!

crypto map bar 10 ipsec-isakmp

 set peer 25.0.0.7

 set transform-set fooprime

 match address 102

Step 2 Enter the show running-configuration interface type number command to display statistics for the encrypting router egress interface. If the feature is enabled, you will observe output similar to the following: 

Router# show running-configuration interface fastethernet 0/0

interface FastEthernet0/0

 ip address 25.0.0.6 255.0.0.0

 no ip mroute-cache

 load-interval 30

 duplex full

 speed 100

 crypto map bar

If the feature has been disabled, you will observe output similar to the following:

Router# show running-configuration interface fastethernet 0/0 

interface FastEthernet0/0

 ip address 25.0.0.6 255.0.0.0

 no ip mroute-cache

 load-interval 30

 duplex full

 speed 100

 crypto map bar

 crypto ipsec fragmentation after-encryption

Configuration Examples

This section provides the following configuration example:

•Enabling Pre-Fragmentation For IPsec VPNs Example

Enabling Pre-Fragmentation For IPsec VPNs Example

The following configuration example shows how to configure the Pre-Fragmentation for IPsec VPNs feature:

Note This feature does not show up in the running configuration in this example because the default global pre-fragmentation for IPsec VPNs feature is enabled. Pre-fragmentation for IPsec VPNs shows in the running configuration only when you explicitly enable the feature on the interface. 

crypto isakmp policy 10

 authentication pre-share

crypto isakmp key abcd123 address 25.0.0.7

!

!

crypto ipsec transform-set fooprime esp-3des esp-sha-hmac

!

crypto map bar 10 ipsec-isakmp

 set peer 25.0.0.7

 set transform-set fooprime

 match address 102

Command Reference

The following commands are introduced or modified in the feature or features

•crypto ipsec fragmentation

•crypto ipsec fragmentation (interface configuration)

For information about these commands, see the Cisco IOS Security Command Reference at

http://www.cisco.com/en/US/docs/ios/security/command/reference/sec_book.html.

For information about all Cisco IOS commands, see the Command Lookup Tool at

http://tools.cisco.com/Support/CLILookup or the Master Command List.

CCDE, CCENT, CCSI, Cisco Eos, Cisco HealthPresence, Cisco IronPort, the Cisco logo, Cisco Lumin, Cisco Nexus, Cisco Nurse Connect, Cisco Pulse, Cisco StackPower, Cisco StadiumVision, Cisco TelePresence, Cisco Unified Computing System, Cisco WebEx, DCE, Flip Channels, Flip for Good, Flip Mino, Flipshare (Design), Flip Ultra, Flip Video, Flip Video (Design), Instant Broadband, and Welcome to the Human Network are trademarks; Changing the Way We Work, Live, Play, and Learn, Cisco Capital, Cisco Capital (Design), Cisco:Financed (Stylized), Cisco Store, and Flip Gift Card are service marks; and Access Registrar, Aironet, AllTouch, AsyncOS, Bringing the Meeting To You, Catalyst, CCDA, CCDP, CCIE, CCIP, CCNA, CCNP, CCSP, CCVP, Cisco, the Cisco Certified Internetwork Expert logo, Cisco  IOS, Cisco Press, Cisco Systems, Cisco Systems Capital, the Cisco Systems logo, Cisco Unity, Collaboration Without Limitation, Continuum, EtherFast, EtherSwitch, Event Center, Explorer, Fast Step, Follow Me Browsing, FormShare, GainMaker, GigaDrive, HomeLink, iLYNX, Internet Quotient, IOS, iPhone, iQuick Study, IronPort, the IronPort logo, Laser Link, LightStream, Linksys, MediaTone, MeetingPlace, MeetingPlace Chime Sound, MGX, Networkers, Networking Academy, Network Registrar, PCNow, PIX, PowerKEY, PowerPanels, PowerTV, PowerTV (Design), PowerVu, Prisma, ProConnect, ROSA, ScriptShare, SenderBase, SMARTnet, Spectrum Expert, StackWise, The Fastest Way to Increase Your Internet Quotient, TransPath, WebEx, and the WebEx logo are registered trademarks of Cisco Systems, Inc. and/or its affiliates in the United States and certain other countries.

All other trademarks mentioned in this document or website are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (0908R)


Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.

© 2009 Cisco Systems, Inc. All rights reserved.