Cisco 3002 - VPN Hardware Client Especificaciones descargar pdf (Pagina 72)

3-8

VPN 3002 Hardware Client Reference, Release 4.0

OL-3813-01

Chapter 3 Interfaces

Configuration | Interfaces | Public

Duplex

If you are using static IP addressing, click the drop-down menu button and select the interface

transmission mode:

• Auto = Let the VPN 3002 automatically detect and set the appropriate transmission mode, either full

or half duplex (default). Be sure that the port on the active network device (hub, switch, router, etc.)

to which you connect this interface is also set to automatically negotiate the transmission mode.

Otherwise, select the appropriate fixed mode.

• Full-Duplex = Fix the transmission mode as full duplex: transmits and receives at the same time.

• Half-Duplex = Fix the transmission mode as half duplex: transmits or receives, but not at the same

time.

MTU

The MTU value specifies the maximum transmission unit (packet size) in bytes for the interface. Valid

values range from 68 through 1500. The default value, 1500, is the MTU for IP.

Change this value only when the VPN 3002 is dropping large packets because of the additional 8 bytes

that a PPPoE header adds, or when other intermediate devices drop large, fragmentable packets without

issuing an ICMP message. In such cases, determine the largest packet size that can pass without being

dropped, and set the MTU to that value. The object is to reduce overhead on the system by sending

packets that are as large as possible, but that are not so large as to require fragmentation and reassembly.

A good way to find out the largest packet size that can be passed is to use the Ping utility as follows:

ping -f -l <packet size in bytes> <destination IP address>, where

f = do not fragment

l = frame length.

For example: ping -f -l 1400 10.10.32.4

Note The value you use when pinging does not include IP, ICMP, or Ethernet headers, which total 42 bytes.

You need to include these 42 bytes when you set the MTU value for the interface.

If the interface is receiving large packets that require fragmentation, and the DF (Don’t Fragment) bit is

set, use the third option in the IPSec Fragmentation Policy field (see below). You can find out if the DF

bit is set by using a traffic analyzer, or you may receive this ICMP message: “Fragmentation required

but the DF bit is set.”

Note Changing the MTU or the fragmentation option on any interface tears down all existing connections.

For example, if 100 active tunnels terminate on the public interface, and you change the MTU on the

private interface, all of the active tunnels on the public interface are dropped.

IPSec Fragmentation Policy

The IPSec fragmentation policy specifies how to treat packets that exceed the MTU setting when

tunneling traffic through the public interface. This feature provides a way to handle cases where a router

or NAT device between the VPN 3002 and the VPN Concentrator rejects or drops IP fragments. For

1 2 ... 67 68 69 70 71 72 73 74 75 76 77 ... 317 318

Sin comentarios

Cisco 3002 - VPN Hardware Client Especificaciones Pagina 72