Question: Is FlexVNF capable of handling DF bit on an ingress packet? 

Answer:

Yes, a tunnel on a FlexVNF device can handle a packet whose header contains the DF bit. If the received packet's size is larger than the tunnel's MTU and the DF bit is disabled, the packet is fragmented before it exits the tunnel. If the DF bit is enabled, this packet is dropped. 

Starting with Release 16.1R2-S6, you can override the DF bit so that a packet is fragmented, if necessary, before it exits the tunnel.

admin@Silver-Customer-CPE61-cli(config)% set orgs org-services Tenant-Common options

Possible completions:

override-df-bit - Override the DF (Don't Fragment) Bit and fragment packets when necessary

NOTE: While he DF bit override feature was introduced in Release 16.1R2-S6,  it started working consistently in Release 16.1R2-S7.