NP6 session drift

In some cases, sessions processed by NP6 processors may fail to be deleted leading to a large number of idle or orphaned sessions. This is called session drift. You can use SNMP to be alerted when the number of idle sessions becomes high. SNMP also allows you to see which NP6 processor has the abnormal number of idle sessions and you can use a diagnose command to delete them.

The following MIB fields allow you to use SNMP to monitor session table information for NP6 processors including drift for each NP6 processor:

FORTINET-FORTIGATE-MIB::fgNPUNumber.0 = INTEGER: 2

FORTINET-FORTIGATE-MIB::fgNPUName.0 = STRING: NP6

FORTINET-FORTIGATE-MIB::fgNPUDrvDriftSum.0 = INTEGER: 0

FORTINET-FORTIGATE-MIB::fgNPUIndex.0 = INTEGER: 0

FORTINET-FORTIGATE-MIB::fgNPUIndex.1 = INTEGER: 1

FORTINET-FORTIGATE-MIB::fgNPUSessionTblSize.0 = Gauge32: 33554432

FORTINET-FORTIGATE-MIB::fgNPUSessionTblSize.1 = Gauge32: 33554432

FORTINET-FORTIGATE-MIB::fgNPUSessionCount.0 = Gauge32: 0

FORTINET-FORTIGATE-MIB::fgNPUSessionCount.1 = Gauge32: 0

FORTINET-FORTIGATE-MIB::fgNPUDrvDrift.0 = INTEGER: 0

FORTINET-FORTIGATE-MIB::fgNPUDrvDrift.1 = INTEGER: 0

You can also use the following diagnose command to determine if drift is occurring. The command output shows a drift summary for all the NP6 processors in the FortiGate, and shows the total drift. The following example command output, from a FortiGate 1500D, shows that the two NP6 processors in the FortiGate-1500D are not experiencing any drift.

diagnose npu np6 sse-drift-summary 
NPU   drv-drift 
----- --------- 
np6_0 0         
np6_1 0         
----- --------- 
Sum   0       
----- --------- 

For the best results you should restart your FortiGate to remove orphaned sessions causing session drift. However, the following command can be a useful workaround until you are able to restart the FortiGate or if you troubleshooting an issue and want to remove orphaned sessions.

diagnose npu np6 sse-purge-drift <np6_id> [<time>]

Where <np6_id> is the number (starting with NP6_0 with a np6_id of 0) of the NP6 processor for which to delete idle sessions in.

<time> is the time in seconds during which the NP6 processor attempts to delete orphaned sessions. The default time is 300 seconds.

The command instructs the selected NP6 processor to scan session tables and delete (or purge) orphaned sessions, which are sessions that have been idle for a long time. During the session purge, traffic may be disrupted. The longer the purge time, the longer the amount of time that a disruption might occur.

The command purges all orphaned sessions during the specified time and you only have to execute the command once to purge all orphaned sessions.

In most cases the NP6 processor should recover and continue working normally after the purge. In rare cases, the NP6 processor may not be able to recover successfully after the purge and you may need to restart the FortiGate.