FortiGate-VM affinity packet redistribution

With SR-IOV enabled on the VM host and interrupt affinity configured on your FortiGate-VM, there is an additional configuration that you can add that may improve performance. Most common network interface hardware restricts the number of RX/TX queues that it can process. This can result in some CPUs being much busier than others and the busy CPUs may develop extensive queues.

You can get around this potential bottleneck by configuring affinity packet redistribution to allow overloaded CPUs to redistribute packets they receive to other less busy CPUs. The may result in a more even distribution of packet processing to all available CPUs.

You configure packet redistribution for interfaces by associating an interface with an affinity CPU mask. This configuration distributes packets that that interface sets and receives to the CPUs that the CPU affinity mask associated with the interface defines.

You can use the following CLI command to configure affinity packet redistribution for your FortiGate-VM:

config system affinity-packet-redistribution

edit <index>

set interface <interface-name>

set affinity-cpumask <cpu-affinity-mask>

next

The following defines the values for the commands:

Value	Description
<interface-name>	Name of interface to associate with a CPU affinity mast.
<cpu-affinity-mask>	CPU affinity mask for the CPUs that process packets to and from the associated interface.

For example, you can improve the performance of the interrupt affinity example that the following command shows to allow packets that the port3 interface sends and receives to be redistributed to CPUs according to the 0xE CPU affinity mask.

config system affinity-packet-redistribution

edit 1

set interface port3

set affinity-cpumask "0xE"

next

end