Sets the Don’t-Fragment bit to clear or copy. Use no crypto ipsec df-bit to restore the Don’t-Fragment bit to the default value: copy.
clear — the DF bit of the encapsulated packet is never set, and PMTUD is not maintained for the IPSec tunnel. Packets traversing an IPSec tunnel are pre-fragmented according to the MTU of the SA, regardless of their DF bit. In case packets are fragmented, the DF bit is copied to every fragment of the original packet.
copy — the DF bit of the encapsulated packet is copied from the original packet, and Path MTU Discovery (PMTUD) is maintained for the IPSec tunnel.
Syntax
[no] crypto ipsec df-bit {clear | copy}
Parameters
Parameter
Description
Possible Values
Default Value
clear
Keyword indicating to clear the Don’t-Fragment bit
