- Overview of Secure Connectivity
-
- Implementing and Managing PKI Features Roadmap
- Overview of PKI
- Deploying RSA Keys Within a PKI
- Configuring Authorization and Revocation of Certificates in a PKI
- Configuring Certificate Enrollment for a PKI
- Storing PKI Credentials
- Source Interface Selection for Outgoing Traffic with Certificate Authority
- Cisco Group Encrypted Transport VPN
Pre-Fragmentation for IPsec VPNs
Last Updated: March 16, 2011
The Pre-Fragmentation for IPsec VPNs feature increases performance between Cisco IOS XE routers and VPN clients by delivering encryption throughput at maximum encryption hardware accelerator speeds for packets that are near the maximum transmission unit (MTU) size. Packets are fragmented into equally sized units to prevent further downstream fragmentation.
Finding Feature Information
Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the "Feature Information for Pre-Fragmentation for IPsec VPNs" section.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Contents
•Restrictions for Pre-Fragmentation for IPsec VPNs
•Information About Pre-Fragmentation for IPsec VPNs
•How to Configure Pre-Fragmentation for IPsec VPNs
•Feature Information for Pre-Fragmentation for IPsec VPNs
Restrictions for Pre-Fragmentation for IPsec VPNs
Take the following information into consideration before this feature is configured:
•Pre-fragmentation for IPsec VPNs operates in IPsec tunnel mode and IPsec tunnel mode with GRE, but not with IPsec transport mode.
•Pre-fragmentation for IPsec VPNs configured on the decrypting router in a unidirectional traffic scenario does not improve the performance or change the behavior of either of the peers.
•Pre-fragmentation for IPsec VPNs occurs before the transform is applied if compression is turned on for outgoing packets.
•Pre-fragmentation for IPsec VPNs functionality depends on the egress interface crypto ipsec df-bit configuration and the incoming packet "do not fragment" (DF) bit state. See Table 1.
Information About Pre-Fragmentation for IPsec VPNs
•Pre-fragmentation for IPsec VPNs
Pre-fragmentation for IPsec VPNs
When a packet is nearly the size of the MTU of the outbound link of the encrypting router and it is encapsulated with IPsec headers, it is likely to exceed the MTU of the outbound link. This causes packet fragmentation after encryption. The decrypting router must then reassemble these packets in the process path, which decreases the decrypting router's performance.
The Pre-fragmentation for IPsec VPNs feature increases the decrypting router's performance by enabling it to operate in the high-performance CEF path instead of the process path. An encrypting router can predetermine the encapsulated packet size from information available in transform sets, which are configured as part of the IPsec security association (SA). If it is predetermined that the packet exceeds the MTU of the output interface, the packet is fragmented before encryption. This function avoids process-level reassembly before decryption and helps improve decryption performance and overall IPsec traffic throughput.
Note The pre-fragmentation feature is turned off by default for tunnel interfaces. To receive pre-fragmentation performance benefits, turn pre-fragmentation on after ensuring that the tunnel interfaces have the same MTU on both ends.
Crypto maps are no longer used to define fragmentation behavior that occurred before and after encryption. Now, IPsec Virtual Tunnel Interface (also referred to as Virtual-Template interface) (VTI) fragmentation behavior is determined by the IP MTU settings that are configured on the VTI.
See the IPsec Virtual Tunnel Interface feature document for more information on VTIs.
Note If fragmentation after-encryption behavior is desired, then set the VTI IP MTU to a value that is greater than the egress router interface IP MTU. Use the show ip interface tunnel command to display the IP MTU value.
How to Configure Pre-Fragmentation for IPsec VPNs
This section contains the following task:
•Configuring Pre-Fragmentation for IPsec VPNs
Configuring Pre-Fragmentation for IPsec VPNs
Perform this task to configure Pre-Fragmentation for IPsec VPNs.
SUMMARY STEPS
1. enable
2. configure terminal
3. interface type number
4. ip mtu bytes
DETAILED STEPS
Additional References
Related Documents
|
|
---|---|
Cisco IOS XE commands |
|
Security commands |
|
IPsec |
IPsec Virtual Tunnel Interface feature document |
MIBs
|
|
---|---|
None |
To locate and download MIBs for selected platforms, Cisco software releases, and feature sets, use Cisco MIB Locator found at the following URL: |
Technical Assistance
Feature Information for Pre-Fragmentation for IPsec VPNs
Table 2 lists the release history for this feature.
Use Cisco Feature Navigator to find information about platform support and software image support. Cisco Feature Navigator enables you to determine which software images support a specific software release, feature set, or platform. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Note Table 2 lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.