To Next Page

To Previous Page

323

Default

The DF bit is not set for outer IP headers of encapsulated IPsec packets on an interface. The global DF bit

is used.

Views

Interface view

Predefined user roles

network-admin

Parameters

clear: Clears the DF bit for outer IP headers. In this case, the encapsulated IPsec packets can be

fragmented.

copy: Copies the DF bit of the original IP headers to the outer IP headers.

set: Sets the DF bit for outer IP headers. In this case, the encapsulated IPsec packets cannot be

fragmented.

Usage guidelines

This command is effective only when the IPsec encapsulation mode is tunnel mode. It is not effective in

transport mode because outer IP headers are not added in transport mode.

This command does not change the DF bit for the original IP headers of encapsulated packets.

If multiple interfaces have referenced an IPsec policy that is bound to a source interface, you must use the

same DF bit setting on these interfaces.

Packet fragmentation and reassembly might cause packet forwarding to be delayed. If you set the DF bit

for encapsulated IPsec packets, the packets will not be fragmented. In this case, make sure the MTU on

each interface along the forwarding path is larger than the IPsec packet length. Otherwise, the packets

are discarded. If you cannot make sure of the MTU value, HP recommends that you clear the DF bit.

Examples

# Set the DF bit for outer IP headers of encapsulated IPsec packets on GigabitEthernet2/1/2.

<Sysname> system-view

[Sysname] interface gigabitethernet 2/1/2

[Sysname-GigabitEthernet2/1/2] ipsec df-bit set

Related commands

ipsec global-df-bit

Use ipsec global-df-bit to set the DF bit for outer IP headers of encapsulated IPsec packets on all

interfaces.

Use undo ipsec global-df-bit to restore the default.

Syntax

ipsec global-df-bit { clear | copy | set }

undo ipsec global-df-bit

HP MSR SERIES Command Reference

Other manuals for HP MSR SERIES