Pre-Fragmentation for IPsec VPNs

The Pre-Fragmentation for IPsec VPNs feature increases performance between Cisco IOS XE routers and VPN clients by delivering encryption throughput at maximum encryption hardware accelerator speeds for packets that are near the maximum transmission unit (MTU) size. Packets are fragmented into equally sized units to prevent further downstream fragmentation.

Finding Feature Information

Your software release may not support all the features documented in this module. For the latest caveats and feature information, see Bug Search Tool and the release notes for your platform and software release. To find information about the features documented in this module, and to see a list of the releases in which each feature is supported, see the feature information table.

Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/​go/​cfn. An account on Cisco.com is not required.

Restrictions for Pre-Fragmentation for IPsec VPNs

Take the following information into consideration before this feature is configured:

  • Pre-fragmentation for IPsec VPNs operates in IPsec tunnel mode and IPsec tunnel mode with GRE, but not with IPsec transport mode.

  • Pre-fragmentation for IPsec VPNs configured on the decrypting router in a unidirectional traffic scenario does not improve the performance or change the behavior of either of the peers.

  • Pre-fragmentation for IPsec VPNs occurs before the transform is applied if compression is turned on for outgoing packets.

  • Pre-fragmentation for IPsec VPNs functionality depends on the egress interface crypto ipsec df-bit configuration and the incoming packet “do not fragment” (DF) bit state. See the table below.

Table 1 Pre-Fragmentation for IPsec VPNs Dependencies

Pre-Fragmentation for IPsec VPNs Feature State (Enabled/Disabled)

Egress Interface “crypto ipsec df-bit” Configuration

Incoming Packet DF Bit State

Result

Enabled

crypto ipsec df-bit clear

0

Fragmentation occurs before encryption.

Enabled

crypto ipsec df-bit clear

1

Fragmentation occurs before encryption.

Disabled

crypto ipsec df-bit clear

0

Fragmentation occurs after encryption and packets are reassembled before decryption.

Disabled

crypto ipsec df-bit clear

1

Fragmentation occurs after encryption and packets are reassembled before decryption.

Enabled

crypto ipsec df-bit set

0

Fragmentation occurs before encryption.

Enabled

crypto ipsec df-bit set

1

Packets are dropped.

Disabled

crypto ipsec df-bit set

0

Fragmentation occurs after encryption and packets are reassembled before decryption.

Disabled

crypto ipsec df-bit set

1

Packets are dropped.

Enabled

crypto ipsec df-bit copy

0

Fragmentation occurs before encryption.

Enabled

crypto ipsec df-bit copy

1

Packets are dropped.

Disabled

crypto ipsec df-bit copy

0

Fragmentation occurs after encryption, and packets are reassembled before decryption.

Disabled

crypto ipsec df-bit copy

1

Packets are dropped.

Information About Pre-Fragmentation for IPsec VPNs

Pre-fragmentation for IPsec VPNs

When a packet is nearly the size of the MTU of the outbound link of the encrypting router and it is encapsulated with IPsec headers, it is likely to exceed the MTU of the outbound link. This causes packet fragmentation after encryption. The decrypting router must then reassemble these packets in the process path, which decreases the decrypting router’s performance.

The Pre-fragmentation for IPsec VPNs feature increases the decrypting router’s performance by enabling it to operate in the high-performance CEF path instead of the process path. An encrypting router can predetermine the encapsulated packet size from information available in transform sets, which are configured as part of the IPsec security association (SA). If it is predetermined that the packet exceeds the MTU of the output interface, the packet is fragmented before encryption. This function avoids process-level reassembly before decryption and helps improve decryption performance and overall IPsec traffic throughput.


Note

The pre-fragmentation feature is turned off by default for tunnel interfaces. To receive pre-fragmentation performance benefits, turn pre-fragmentation on after ensuring that the tunnel interfaces have the same MTU on both ends.

Crypto maps are no longer used to define fragmentation behavior that occurred before and after encryption. Now, IPsec Virtual Tunnel Interface (also referred to as Virtual-Template interface) (VTI) fragmentation behavior is determined by the IP MTU settings that are configured on the VTI.

See the IPsec Virtual Tunnel Interface feature document for more information on VTIs.


Note

If fragmentation after-encryption behavior is desired, then set the VTI IP MTU to a value that is greater than the egress router interface IP MTU. Use the show ip interface tunnelcommand to display the IP MTU value.

How to Configure Pre-Fragmentation for IPsec VPNs

Configuring Pre-Fragmentation for IPsec VPNs

Perform this task to configure Pre-Fragmentation for IPsec VPNs.

SUMMARY STEPS

    1.    enable

    2.    configure terminal

    3.    interface type number

    4.    ip mtu bytes


DETAILED STEPS
     Command or ActionPurpose
    Step 1 enable


    Example:
    Router> enable
     

    Enables privileged EXEC mode.

    • Enter your password if prompted.

     
    Step 2 configure terminal


    Example:
    Router# configure terminal
     

    Enters global configuration mode.

     
    Step 3 interface type number


    Example:
    Router(config-if)# interface tunnel0
     

    Specifies the interface on which the VTI is configured and enters interface configuration mode.

     
    Step 4 ip mtu bytes


    Example:
    Router(config-if)# ip mtu 1500


    Example:
    

        
    
 
          		 
          
    
Specifies the VTI MTU size in bytes of IP packets on the egress interface for IPsec VPNs.
    

          
    Note   
                
              
    
If after-encryption fragmentation behavior is desired, then set the VTI IP MTU to a value that is greater than the egress router interface IP MTU. Use the show ip interface tunnelcommand to display the IP MTU value.
    

    

         
      
    

    

    

    

    

    Additional References
    

     
	 
    

    Related Documents
     
		 
		

     
					 
     Related Topic
					 
    
 
				      		
 
					 
     Document Title
					 
    
 
				      		

    
    

     
					 
     Cisco IOS XE commands
					 
    
 
				      		
 
					 
     
						Cisco IOS Master Commands List, All Releases 
					 
    
 
				      		

    

     
					 
     Security commands
					 
    
 
				      		
 
					 
     Cisco IOS Security Command Reference 
					 
    
 
				      		

    

     
					 
     IPsec
					 
    
 
				      		
 
					 
     IPsec Virtual Tunnel Interface feature document
					 
    
 
				      		

    
    

    

    
 
	 
    

    MIBs
     
		 
		

     
					 
     MIB
					 
    
 
				      		
 
					 
     MIBs Link
					 
    
 
				      		

    
    

     
					 
     None
					 
    
 
				      		
 
					 
     To locate and download MIBs for selected platforms, Cisco software releases, and feature sets, use Cisco MIB Locator found at the following URL:
					 
    
 
					 
     
						http:/​/​www.cisco.com/​go/​mibs 
					 
    
 
				      		

    
    

    

    
 
	 
    

    Technical Assistance
     
		 
		

     
					 
     Description
					 
    
 
				      		
 
					 
     Link
					 
    
 
				      		

    
    

     
					 
     The Cisco Support and Documentation website provides online resources to download documentation, software, and tools. Use these resources to install and configure the software and to troubleshoot and resolve technical issues with Cisco products and technologies. Access to most tools on the Cisco Support and Documentation website requires a Cisco.com user ID and password. 
					 
    
 
				      		
 
					 
     
						http:/​/​www.cisco.com/​cisco/​web/​support/​index.html 
					 
    
 
				      		

    
    

    

    
 
	 
    

    

    

    Feature Information for Pre-Fragmentation for IPsec VPNs
    

    
			
    The following table provides release information about the feature or features described in this module. This table lists only the software release that introduced support for a given feature in a given software release train. Unless noted otherwise, subsequent releases of that software release train also support that feature. 
    
 Use Cisco Feature Navigator to find information about platform support and Cisco software image support. To access Cisco Feature Navigator, go to www.cisco.com/​go/​cfn. An account on Cisco.com is not required. 
    

     
		

    Table 2 Feature Information for Pre-Fragmentation for IPsec VPNs
     
				  
     Feature Name 
				  
    
 
				    		
 
				  
     Releases 
				  
    
 
				    		
 
				  
     Feature Information 
				  
    
 
				    		

    
    

     
				  
     Pre-Fragmentation for IPsec VPNs 
				  
    
 
				    		
 
				  
     Cisco IOS XE 2.1 
				  
    
 
				    		
 
				  
     This feature increases performance between Cisco IOS routers and VPN clients by delivering encryption throughput at maximum encryption hardware accelerator speeds for packets that are near the maximum transmission unit (MTU) size. Packets are fragmented into equally sized units to prevent further downstream fragmentation. 
				  
    
 
				  
     The following command was introduced or modified: 
					 ip 
						mtu 
						(interface 
						configuration) 
					 .