H3C MSR Series Command Reference

540
Parameters
after-encryption: Fragments packets after IPsec encapsulation.
before-encryption: Fragments packets before IPsec encapsulation.
Usage guidelines
If you configure the device to fragment packets before IPsec encapsulation, the device
predetermines the encapsulated packet size before the actual encapsulation. If the encapsulated
packet size exceeds the MTU of the output interface, the device fragments the packets before
encapsulation. If a packet's DF bit is set, the device drops the packet and sends an ICMP error
message.
If you configure the device to fragment packets after IPsec encapsulation, the device directly
encapsulates the packets and fragments the encapsulated packets in subsequent service modules.
Examples
# Configure the device to fragment packets after IPsec encapsulation.
<Sysname>system-view
[Sysname] ipsec fragmentation after-encryption
ipsec global-df-bit
Use ipsec global-df-bit to configure the DF bit for the outer IP header of IPsec packets on all
interfaces.
Use undo ipsec global-df-bit to restore the default.
Syntax
ipsec global-df-bit { clear | copy | set }
undo ipsec global-df-bit
Default
The DF bit setting of the original IP header is copied to the outer IP header for IPsec packets.
Views
System view
Predefined user roles
network-admin
Parameters
clear: Clears the DF bit in the outer IP header. IPsec packets can be fragmented.
copy: Copies the DF bit setting of the original IP header to the outer IP header.
set: Sets the DF bit in the outer IP header. IPsec packets cannot be fragmented.
Usage guidelines
This command is effective only when the IPsec encapsulation mode is tunnel mode. It is not effective
in transport mode because the outer IP header is not added in transport mode.
This command does not change the DF bit for the original IP header of IPsec packets.
Packet fragmentation and reassembly might cause packet forwarding to be delayed. You can set the
DF bit to avoid the forwarding delay. However, to prevent IPsec packets from being discarded, you
must make sure the path MTU is larger than the IPsec packet size. As a best practice, clear the DF
bit if you cannot make sure the path MTU is larger than the IPsec packet size.

H3C MSR Series Specifications

General

Category	Network Router
IPv6 Support	Yes
Dimensions	Varies by model
Weight	Varies by model
Product Type	Modular Router
Ports	Varies by model
WAN Interfaces	Varies by model
Firewall	Yes
QoS	Yes
Wireless Support	Varies by model
USB Ports	Varies by model
Console Port	Yes
Power Supply	Varies by model
Redundancy	Varies by model
Operating Temperature	0°C to 45°C
Storage Temperature	-40°C to 70°C
Humidity	5% to 95% non-condensing
Series	MSR
Certifications	CE, FCC, RoHS