uOS IPv4 Pre-IPsec Fragmentation Configuration and Behavior Guide

Zyxel_Avani

1. Overview & Background

In the uOS architecture, TCP traffic is actively protected by built-in MSS Clamping, which automatically adjusts the maximum segment size of TCP connections. Consequently, packet fragmentation caused by exceeding the MTU occurs significantly less often than in legacy ZLD firmware, and uOS does not expose a manual fragmentation toggle in the Web GUI by default.

However, manual intervention may be required in specific operational scenarios:

• Oversized UDP Traffic: Transmitting large UDP datagrams (e.g., VoIP, video streams, proprietary application data) that are not managed by TCP MSS clamping.
• Path MTU Discovery (PMTUD) Black Holes: Intermediate firewalls or routers dropping ICMP needfrag (Type 3, Code 4) packets.
• Decryption Gateway Load Offloading: Enabling pre-IPsec fragmentation allows packets to be fragmented before encapsulation, shifting the reassembly burden onto the destination host of the inner packet rather than the decrypting gateway.

When these conditions apply, administrators can manually configure ipv4-pre-ipsec-fragmentation via nc-cli.

2. Modes & Behavioral Matrix

uOS fast-path provides three operational modes for IPv4 IPsec fragmentation:

CLI Parameter	fp-cli Display	Inner Packet DF=1 & Exceeds MTU	Inner Packet DF=0 & Exceeds MTU	Operational Impact & Behavior
off (Default)	off	Drops packet and returns ICMP needfrag	Post-fragmentation (After encryption)	Standard IPsec behavior. Packets are encapsulated first; if the resulting tunnel packet exceeds MTU, it is fragmented. The peer decrypting gateway must reassemble the outer fragments.
check-df-bit	on	Drops packet and returns ICMP needfrag	Pre-fragmentation (Before encryption)	Honors the DF bit. Packets without the DF bit set are fragmented before encryption. The remote gateway decrypts fragments individually, and reassembly is performed by the destination host.
always	force	Ignores DF, pre-fragmentation (Before encryption)	Pre-fragmentation (Before encryption)	Equivalent to legacy ZLD "Ignore don't fragment." Forces fragmentation before encryption regardless of the DF flag. Ideal for networks where PMTUD is broken.

Key Notes:

This feature applies only in tunnel mode.

To replicate the exact behavior of legacy ZLD "Ignore don't fragment", the CLI value must be set to always.

3. Configuration Procedure

Modifying this advanced fast-path parameter requires nc-cli, and a full system reboot is required for changes to take effect.

Step 1: Access nc-cli and Modify the Setting

Log into the device via SSH or Console:

Plaintext

nc-cli > edit running running config# system fast-path advanced ipv4-pre-ipsec-fragmentation always running config# commit running config# exit

(Replace always with check-df-bit or off depending on the desired behavior).

Step 2: Save to Startup Configuration

Persist the running configuration across reboots:

Plaintext

> copy running startup Overwrite startup configuration? [y/N] y > exit

Step 3: Reboot the System

Execute the reboot command to reload fast-path modules:

Plaintext

> cmd reboot

4. Verification

After the system boots up, verify the operational status:

1. Verify Running Configuration via nc-cli:

Plaintext

nc-cli > show running system fast-path

Confirm that ipv4-pre-ipsec-fragmentation always is present in the output.

2. Verify Fast-Path Engine State via fp-cli:

Run the fast-path diagnostic query to confirm the running mode:

1. Configured as off: displays off
2. Configured as check-df-bit: displays on
3. Configured as always: displays force

5. Rollback Procedure

To revert the system back to the factory default configuration:

Plaintext

nc-cli > edit running running config# system fast-path advanced ipv4-pre-ipsec-fragmentation off running config# commit running config# exit > copy running startup Overwrite startup configuration? [y/N] y > exit > cmd reboot