topic Re: How to clear DF bit on ASA in Network Security

How to clear DF bit on ASA

Ricky Sandhu — Tue, 25 Feb 2025 18:58:13 GMT

Good day, we are having an issue where remote-vpn users connecting via the ASA are unable to access a resource. (Rough diagram attached).

Whenever PC1 is accessing a given resource on the Internet, it has no issues.
However whenever PC2 is accessing the same resource via ASA and FTD, it can't. On FTD the below error gets logged:
Initiator IP: 10.1.1.2 4 (Fragmentation Needed and Don't Fragment was set) / icmp

Why is the ASA setting the DF bit and how can I remove it?

Re: How to clear DF bit on ASA

liviu.gheorghe — Tue, 25 Feb 2025 20:04:18 GMT

Hello @Ricky Sandhu ,

you can clear the DF bit on ASA by using PBR. For this you will need to configure a route-map:

route-map cleardf permit 10

set ip df 0

This route-map should be applied on the interface towards PC2:

policy-route route-map cleardf

What the route-map does is match all traffic coming in that interface because there is no match statement, and to that traffic it sets the DF bit to 0 so it can be fragmented along the way.

Edit: PBR is supported on ASA starting with software version 9.4(1).

HTH

Re: How to clear DF bit on ASA

Ricky Sandhu — Wed, 26 Feb 2025 03:36:25 GMT

Thank you @liviu.gheorghe

I was able to "go around" the issue by routing traffic from the ASA via an IOS router to the destination on the Internet for now. But I will keep this in my back pocket for future