VFR is designed to
work with any feature that requires fragment reassembly (such as Cisco IOS XE
Firewall, NAT, and IPSec). By default, NAT, Cisco IOS XE Firewall, Crypto-based
IPSec, NAT64, and onePK enable and disable VFR internally; that is, when these
features are enabled on an interface, VFR is automatically enabled on that
interface.
If more than one
feature attempts to automatically enable VFR on an interface, VFR maintains a
reference count to keep track of the number of features that have enabled VFR.
When the reference count is reduced to zero, VFR is automatically disabled.
If NAT is enabled on
an interface (such as GigabitEthernet 0/0/0), VFR (input/output) is enabled on
this interface.
Device(config-if)# do show ip virtual-reassembly features
GigabitEthernet0/0/0:
Virtual Fragment Reassembly (VFR) Current Status is ENABLED [in]
Features to use if VFR is Enabled:NAT
GigabitEthernet0/0/0:
Virtual Fragment Reassembly (VFR) Current Status is ENABLED [out]
Features to use if VFR is Enabled:NAT
If Cisco IOS XE
Firewall is enabled on an interface (such as GigabitEthernet 0/0/0), VFR (out)
is enabled on this interface.
Device(config-if)# do show ip virtual-reassembly features
GigabitEthernet0/0/0:
Virtual Fragment Reassembly (VFR) Current Status is ENABLED [out]
Features to use if VFR is Enabled:FW
If IPSec is enabled on
an interface (such as GigabitEthernet 0/0/0), VFR (out) is enabled on this
interface.
Device(config-if)# do show ip virtual-reassembly features
GigabitEthernet0/0/0:
Virtual Fragment Reassembly (VFR) Current Status is ENABLED [out]
Features to use if VFR is Enabled:IPSec
Note |
If VFR is enabled by
features such as NAT and Cisco IOS XE Firewall, the
ip virtual-reassembly
[-out] command is not displayed in the output of the
show
running-config command.
VFR can be manually
enabled or disabled using the
[no ]
ip
virtual-reassembly [-out] command.
If VFR is manually
enabled, regardless of whether it is enabled by features such as NAT and Cisco
IOS XE Firewall, the
ip virtual-reassembly
[-out] command is displayed in the output of the
show
running-config command.
|