Should "ip virtual-reassembly" be enabled on Tunnel Interface?

[Andrew Xue Zheng Lay]

Hi,

I know that NAT automatically turns on "ip virtual-reassembly".

But I've also seen them on some configurations like:

interface Virtual-Template1 type tunnel
  ip unnumbered GigabitEthernet0/1
  ip virtual-reassembly
  tunnel mode ipsec ipv4
  tunnel protection ipsec profile VTI

or

interface tunnel 0
  ip virtual-reassembly

Are they required on such scenarios?

[Mark Malone]

its basically a command for an interface to prevent an attacker from flooding the buffer with incomplete fragment packets that the router keeps trying to reassemble causing resource issues memory etc , this puts a threshold on the interface preventing that ,whether physical or virtual , depends on your network and its requirements whether you want to use it