The documentation set for this product strives to use bias-free language. For the purposes of this documentation set, bias-free is defined as language that does not imply discrimination based on age, disability, gender, racial identity, ethnic identity, sexual orientation, socioeconomic status, and intersectionality. Exceptions may be present in the documentation due to language that is hardcoded in the user interfaces of the product software, language used based on RFP documentation, or language that is used by a referenced third-party product. Learn more about how Cisco is using Inclusive Language.
The Pre-Fragmentation for IPsec VPNs feature increases performance between Cisco IOS routers and VPN clients by delivering encryption throughput at maximum encryption hardware accelerator speeds for packets that are near the maximum transmission unit (MTU) size. Packets are fragmented into equally sized units to prevent further downstream fragmentation.
Your software release may not support all the features documented in this module. For the latest feature information and caveats, see the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the Feature Information Table at the end of this document.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Take the following information into consideration before this feature is configured:
Table 1 | Pre-Fragmentation for IPsec VPNs Dependencies |
Pre-Fragmentation for IPsec VPNs Feature State (Enabled/Disabled) |
Egress Interface "crypto ipsec df-bit" Configuration |
Incoming Packet DF Bit State |
Result |
---|---|---|---|
Enabled |
crypto ipsec df-bit clear |
0 |
Fragmentation occurs before encryption. |
Enabled |
crypto ipsec df-bit clear |
1 |
Fragmentation occurs before encryption. |
Disabled |
crypto ipsec df-bit clear |
0 |
Fragmentation occurs after encryption and packets are reassembled before decryption. |
Disabled |
crypto ipsec df-bit clear |
1 |
Fragmentation occurs after encryption and packets are reassembled before decryption. |
Enabled |
crypto ipsec df-bit set |
0 |
Fragmentation occurs before encryption. |
Enabled |
crypto ipsec df-bit set |
1 |
Packets are dropped. |
Disabled |
crypto ipsec df-bit set |
0 |
Fragmentation occurs after encryption and packets are reassembled before decryption. |
Disabled |
crypto ipsec df-bit set |
1 |
Packets are dropped. |
Enabled |
crypto ipsec df-bit copy |
0 |
Fragmentation occurs before encryption. |
Enabled |
crypto ipsec df-bit copy |
1 |
Packets are dropped. |
Disabled |
crypto ipsec df-bit copy |
0 |
Fragmentation occurs after encryption, and packets are reassembled before decryption. |
Disabled |
crypto ipsec df-bit copy |
1 |
Packets are dropped. |
When a packet is nearly the size of the MTU of the outbound link of the encrypting router and it is encapsulated with IPsec headers, it is likely to exceed the MTU of the outbound link. This causes packet fragmentation after encryption. The decrypting router must then reassemble these packets in the process path, which decreases the decrypting router's performance.
The Pre-fragmentation for IPsec VPNs feature increases the decrypting router's performance by enabling it to operate in the high-performance CEF path instead of the process path. An encrypting router can predetermine the encapsulated packet size from information available in transform sets, which are configured as part of the IPsec security association (SA). If it is predetermined that the packet exceeds the MTU of the output interface, the packet is fragmented before encryption. This function avoids process-level reassembly before decryption and helps improve decryption performance and overall IPsec traffic throughput.
![]() Note |
The pre-fragmentation feature is turned off by default for tunnel interfaces. To receive pre-fragmentation performance benefits, turn pre-fragmentation on after ensuring that the tunnel interfaces have the same MTU on both ends. |
Crypto maps are no longer used to define fragmentation behavior that occurred before and after encryption. Now, IPsec Virtual Tunnel Interface (also referred to as Virtual-Template interface) (VTI) fragmentation behavior is determined by the IP MTU settings that are configured on the VTI.
See the IPsec Virtual Tunnel Interface feature document for more information on VTIs.
![]() Note |
If fragmentation after-encryption behavior is desired, then set the VTI IP MTU to a value that is greater than the egress router interface IP MTU. Use the show ip interface tunnelcommand to display the IP MTU value. |
Perform this task to configure Pre-Fragmentation for IPsec VPNs.
Related Topic |
Document Title |
---|---|
Cisco IOS commands |
|
Security commands |
Cisco IOS Security Command Reference |
IPsec |
IPsec Virtual Tunnel Interface feature document |
MIB |
MIBs Link |
---|---|
None |
To locate and download MIBs for selected platforms, Cisco software releases, and feature sets, use Cisco MIB Locator found at the following URL: |
Description |
Link |
---|---|
The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password. |
The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature.
Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/go/cfn. An account on Cisco.com is not required.
Table 2 | Feature Information for Pre-Fragmentation for IPsec VPNs |
Feature Name |
Releases |
Feature Information |
---|---|---|
Pre-Fragmentation for IPsec VPNs |
12.1(11b)E 12.2(13)T 12.2(14)S |
This feature increases performance between Cisco IOS routers and VPN clients by delivering encryption throughput at maximum encryption hardware accelerator speeds for packets that are near the maximum transmission unit (MTU) size. Packets are fragmented into equally sized units to prevent further downstream fragmentation. The following command was introduced or modified: ip mtu (interface configuration) . |
Cisco and the Cisco Logo are trademarks of Cisco Systems, Inc. and/or its affiliates in the U.S. and other countries. A listing of Cisco's trademarks can be found at www.cisco.com/go/trademarks. Third party trademarks mentioned are the property of their respective owners. The use of the word partner does not imply a partnership relationship between Cisco and any other company. (1005R)
Any Internet Protocol (IP) addresses and phone numbers used in this document are not intended to be actual addresses and phone numbers. Any examples, command display output, network topology diagrams, and other figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses or phone numbers in illustrative content is unintentional and coincidental.