Showing results for 
Search instead for 
Did you mean: 

ip virtual-reassembly counts



Expieriencing some increasing timeouts on ip virtual-reassembly



Virtual Fragment Reassembly (VFR) is ENABLED [in]
Concurrent reassemblies (max-reassemblies): 16
Fragments per reassembly (max-fragments): 32
Reassembly timeout (timeout): 60 seconds
Drop fragments: OFF

Current reassembly count:0
Current fragment count:0
Total reassembly count:2557797
Total reassembly timeout count:13961



This is ip nat inside interface


Kinda confused that there are reassembles IN, leading from local network. Though I don't expirience any visible issues while connecting to internet, what can happen if I turn it off? Should I? Why are there even fragments, if all interface leading from clients to the core are 1500 MTU.

2 Replies 2

Georg Pauwen
VIP Master VIP Master
VIP Master



the fragments are most likely caused by NAT. Have a look at the explanantion below. The 'reassembly timeout' value, by the way, is not a dynamic value, but a value you set under the interface, with the command 'ip virtual-reassembly in timeout'. The default is 3...


--> Virtual fragmentation reassembly (VFR) is automatically enabled by some features (such as NAT, Cisco IOS XE Firewall, IPSec) to get Layer 4 or Layer 7 information. VFR enables the Cisco IOS XE Firewall to create appropriate dynamic access control lists (ACLs) to protect the network from various fragmentation attacks.

Most non-initial fragments do not have the Layer 4 header because it usually travels with the initial fragments (except in the case of micro-fragmentation and tiny fragments). Due to this, some features (such as NAT, Cisco IOS XE Firewall, IPSec) are unable to gather port information from the packet. These features may need to inspect the Layer 7 payload, for which the fragments need to be reassembled, and then refragmented later.


So, if you disable NAT on the interface, the count will probably drop to zero.

I didn't disable NAT, but I disabled virtual reassembly. It did not affect the traffic in any way which is kinda odd. I don't see any increasing drops on interface itself either.

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers