Fixes to NTurbo and IPSA and IPSA offloads flow-based advanced pattern matching. More information about NP7 traffic shaping added to NP7 traffic shaping. Added a disclaimer to CP9, CP9XLite, and CP9Lite capabilities.

New sections:

• diagnose sys session list and no_ofld_reason field (NP7 session information).

• diagnose sys session list no_ofld_reason field.

Previous versions of this document incorrectly stated that NP6 processors support offloading DoS policy sessions. This has been corrected throughout the document as required.

Changes to config hpe and the HPE section of Configuring individual NP6 processors.

Corrections to Disabling NP offloading for firewall policies and Disabling nTurbo for firewall policies.

Moved information about improving CPS performance to sections describing the following FortiGate models that support this feature:

• FortiGate 1200D fast path architecture.

• FortiGate 1500D fast path architecture.

• FortiGate 1500DT fast path architecture.

Correction to Disabling NP offloading for firewall policies.

New section Disabling nTurbo for firewall policies.

Removed the incorrect section "Disabling CP offloading for firewall policies".

Added more information about the NP6XLite processor to Network processors (NP7, NP6, NP6XLite, NP6Lite, and NP4) and NP6XLite processors.

New section: NP acceleration, virtual clustering, and VLAN MAC addresses. Fixes to NP6 session drift. Removed the information about CP9 support for a true random number generator and entropy source from CP9, CP9XLite, and CP9Lite capabilities.

Updated NTurbo offloads flow-based processing to clarify that NTurbo also applies to IPsec VPN sessions.

Corrected errors in the section FortiGate 100F and 101F fast path architecture.

Included NP7 in the statement "Maximum frame size for NP2, NP4, NP6, and NP7 processors is 9216 bytes." in the section Network processors (NP7, NP6, NP6XLite, NP6Lite, and NP4). Corrected the commands used to set a fixed time interval in Configuring NP6 session timeouts.

Corrected integrated switch fabric information in the following sections:

• FortiGate 300E and 301E fast path architecture.

• FortiGate 400E and 401E fast path architecture.

• FortiGate 500E and 501E fast path architecture.

• FortiGate 600E and 601E fast path architecture.

Added a bullet point about NP7 support for offloading traffic, including IPsec traffic, over a loopback interface to NP7 session fast path requirements.

New section: FPM-7630E fast path architecture.

Corrected the output of the get hardware npu np6 port-list command in FortiGate 3600E and 3601E fast path architecture.

Corrected names of encryption and authentication algorithms in NP7 session fast path requirements.

Updated the architecture sections for most E and F models to include more information about management/HA and data processing separation. For example, see the following:

• FortiGate 1800F and 1801F fast path architecture.

• FortiGate 1100E and 1101E fast path architecture.

• FortiGate 100F and 101F fast path architecture.

• FortiGate 200E and 201E fast path architecture.

Corrected the get hardware npu np6 port-list command output in FortiGate 1100E and 1101E fast path architecture.

New section: Protocols that can be offloaded by NP7 processors.

More information and corrections about SOC4 (NP6XLite and CP9XLite) and SOC3 (NP6Lite and CP9Lite).

• Network processors (NP7, NP6, NP6XLite, NP6Lite, and NP4).

• NP6XLite processors.

• NP6Lite processors.

• Content processors (CP9, CP9XLite, CP9Lite).

• FortiGate 60F and 61F fast path architecture.

• FortiGate 100F and 101F fast path architecture.

• FortiGate 100E and 101E fast path architecture.

• FortiGate 200E and 201E fast path architecture.

Misc. changes and fixes.

Added bypass interface information to FortiGate 800D fast path architecture. Minor improvements to the bypass interface information in FortiGate 2500E fast path architecture.

Information about setting interface speeds added to FortiGate 3400E and 3401E fast path architecture and FortiGate 3600E and 3601E fast path architecture. Removed the FortiGate-3900E family from Eliminating dropped packets on LAG interfaces. Improved information about how for NP7 and many more recent NP6 fast path architectures the HA interfaces are not connected to the NP7 or NP6 processors. Information about bypass mode added to FortiGate 2500E fast path architecture. Corrected the output of the diagnose npu np6 port-list command in FortiGate 3960E fast path architecture.

Added NP6XLite content, for example: NP6XLite processors.

Hardware architectures added or changed:

• FortiGate 60F and 61F fast path architecture.
• FortiGate 100F and 101F fast path architecture.
• FortiGate 100E and 101E fast path architecture.
• FortiGate 500E and 501E fast path architecture.
• FortiGate 600E and 601E fast path architecture.

NP7 content added. The NP7 features described in this document are supported by the FortiGate-1800F and 1801F running FortiOS 6.0.9 build 6778.

• NP7 acceleration.
• FortiGate 1800F and 1801F fast path architecture.

Corrected the get hardware npu np6 port-list output in FortiGate 3400E and 3401E fast path architecture.

Added information about interface groups for the following models:

• FortiGate 1100E and 1101E fast path architecture.
• FortiGate 2200E and 2201E fast path architecture.
• FortiGate 3400E and 3401E fast path architecture.
• FortiGate 3600E and 3601E fast path architecture.
• FortiGate-6000 series.

Added a note about ESP in UDP sessions (UDP port 4500) not been offloaded by NP6 processors to NP6 session fast path requirements.

Corrections to Dedicated management CPU.

Changes to Disabling NP6, NP6XLite, and NP6Lite hardware acceleration (fastpath).

New 6.0.9 features added, see What's new in FortiOS 6.0.9.

Other new and improved sections:

• Interface to CPU mapping.
• Multicast per-session accounting.
• IPv6 IPsec VPN over NPU VDOM links.
• Improvements to the information about the HPE in Configuring individual NP6 processors.
• The HPE and changing BGP, SLBC, and BFD priority.
• Eliminating dropped packets on LAG interfaces.

New FortiGate models added:

• FortiGate 2200E and 2201E fast path architecture.
• FortiGate 3300E and 3301E fast path architecture.

Changes to the following sections to enhance information about interface, NP6, and XAUI mapping and about the HA interfaces.

• FortiGate 1100E and 1101E fast path architecture.
• FortiGate 3400E and 3401E fast path architecture
• FortiGate 3600E and 3601E fast path architecture
• Optimizing NP6 performance by distributing traffic to XAUI links
• Increasing NP6 offloading capacity using link aggregation groups (LAGs)

New section: FortiGate 1100E and 1101E fast path architecture.

FortiOS 6.0.6 document release. Minor updates.

Corrected the diagram in FortiGate 400E and 401E fast path architecture.

Minor updates.

FortiOS 6.0.5 document release. Minor updates.

FortiGate-6000 information added to FortiGate-6000 series. FortiGate-7000E information added as well, starting with FortiGate-7030E fast path architecture.

New model added: FortiGate 400E and 401E fast path architecture.

New models added: FortiGate 600E and 601E fast path architecture, and FortiGate 3400E and 3401E fast path architecture.