Cisco 3002 - VPN Hardware Client Especificaciones descargar pdf (Pagina 73)

3-9

VPN 3002 Hardware Client Reference, Release 4.0

OL-3813-01

Chapter 3 Interfaces

Configuration | Interfaces | Public

example, suppose a PC behind a VPN 3002 wants to FTP put a large file to an FTP server behind a VPN

Concentrator. The PC transmits packets that when encapsulated would exceed the VPN 3002’s MTU size

on the public interface. The following options determine how the VPN 3002 processes these packets.

The fragmentation policy you set here applies to all traffic travelling out the VPN 3002 public interface

to VPN Concentrators. The second and third options described below may affect performance rates.

Do not fragment prior to IPSec encapsulation; fragment prior to interface transmission

The VPN 3002 encapsulates all tunneled packets. After encapsulation, the VPN 3002 fragments packets

that exceed the MTU setting before transmitting them through the public interface. This option works

for situations where fragmented packets are allowed through the tunnel without hindrance. For the FTP

example, large packets are encapsulated and then fragmented at the IP layer. Intermediate devices may

drop fragments or just out-of-order fragments. Load-balancing devices can introduce out-of-order

fragments.

Fragment prior to IPSec encapsulation with Path MTU Discovery (ICMP)

The VPN 3002 fragments tunneled packets that would exceed the MTU setting during encapsulation. For

this option, the VPN 3002 drops large packets that have the Don’t Fragment (DF) bit set, and sends an

ICMP message “Packet needs to be fragmented but DF is set” to the packet’s initiator. The ICMP

message includes the maximum MTU size allowed. Path MTU Discovery means that an intermediate

device (in this case the VPN 3002) informs the source of the MTU permitted to reach the destination.

If a large packet does not have the DF bit set, the VPN 3002 fragments prior to encapsulating, thus

creating two independent non-fragmented IP packets, and transmits them out the public interface. This

is the default policy for the VPN 3002 hardware client.

For this example, the PC that is the FTP client may use Path MTU Discovery to adjust the size of the

packets it transmits to this destination.

Fragment prior to IPSec encapsulation without Path MTU Discovery (Clear DF bit)

The VPN 3002 fragments tunneled packets that exceed the MTU setting before encapsulating them. If

the DF bit on these packets is set, the VPN 3002 clears the DF bit, fragments the packets, and then

encapsulates them. This action creates two independent non-fragmented IP packets leaving the public

interface and successfully transmits these packets to the peer site by turning the fragments into complete

packets to be reassembled at the peer site.

In our example, the VPN 3002 overrides the MTU and allows fragmentation by clearing the DF bit.

Apply / Cancel

To apply your settings to this interface and include your settings in the active configuration, click Apply.

The Manager returns to the Configuration | Interfaces screen.

Reminder:

To save the active configuration and make it the boot configuration, click the Save Needed icon at the

top of the Manager window.

To discard your settings, click Cancel. The Manager returns to the Configuration | Interfaces screen.

1 2 ... 68 69 70 71 72 73 74 75 76 77 78 ... 317 318

Sin comentarios

Cisco 3002 - VPN Hardware Client Especificaciones Pagina 73