Cisco IOS XR User Manual

Implementing IPSec Network Security on Cisco IOS XR Software
How to Implement General IPSec Configurations for IPSec Networks
SC-114
Cisco IOS XR System Security Configuration Guide
Configuring the DF Bit for the Encapsulating Header in IPSec Tunnels
This task configures the DF bit for the encapsulating header in IPSec tunnels. The DF bit configuration
is also specified for both service-ipsec and service-gre interfaces.
Note This IPSec feature is supported only on the Cisco IPSec VPN SPA.
SUMMARY STEPS
1. configure
2. crypto ipsec df-bit {clear | set | copy}
3. end
or
commit
DETAILED STEPS
Step 17
show crypto ipsec sa [sa-id | peer ip-address |
profile
profile-name | detail | fvrf fvrf-name
| ivrf
ivrf-name | location location ]
Example:
RP/0/0/CPU0:router# show crypto ipsec sa peer
172.19.72.120
(Optional) Displays SA information based on the
rack/slot/instance location.
• Use the optional detail keyword to display additional
dynamic SA information. The detail keyword is used
only for software-based SAs. SAs that are configured
under the tunnel-ipsec interface or crypto transport.
Step 18
show crypto ipsec summary
Example:
RP/0/0/CPU0:router# show crypto ipsec summary
(Optional) Displays IPSec summary information.
Command or Action Purpose
Command or Action Purpose
Step 1
configure
Example:
RP/0/0/CPU0:router# configure
Enters global configuration mode.
Step 2
crypto ipsec df-bit {clear | set | copy}
Example:
RP/0/0/CPU0:router(config)# crypto ipsec df-bit
clear
or
Sets the DF bit for the encapsulating header in IPSec
tunnels to all interfaces. You must specify at least
one option for the crypto ipsec df-bit command. If
no global setting is set, the default value is set to
clear.

Cisco IOS XR Specifications

General

Operating System	Cisco IOS XR
Architecture	Microkernel
High Availability	Yes
Type	Network operating system
Developed by	Cisco Systems
License	Proprietary
Programming Language	C, C++
Kernel	QNX
Supported Platforms	Cisco ASR9000, NCS series
Security Features	Role-Based Access Control (RBAC), Secure Boot, Encryption
Management Interface	CLI, SNMP, NETCONF, RESTCONF
Release Date	2004
Target Devices	High-end core routers, service provider edge routers, data center interconnect (DCI) routers
Supported Hardware	Cisco routers and switches
Networking Protocols	BGP, OSPF, IS-IS, MPLS
Virtualization Support	Virtualization-ready, supports network function virtualization (NFV) and containerization technologies.