Hardware Acceleration

• Hardware acceleration
• Whats new
  • What's new for FortiGates with NP7 processors for FortiOS 6.2.7
• Content processors (CP9, CP9XLite, CP9Lite)
  • CP9, CP9XLite, and CP9Lite capabilities
  • CP8 capabilities
  • CP6 capabilities
  • CP5 capabilities
  • CP4 capabilities
  • Determining the content processor in your FortiGate unit
  • Viewing SSL acceleration status
• Security processors (SPs)
  • SP processing flow
  • Displaying information about security processing modules
• Network processors (NP7, NP6, NP6XLite, NP6Lite, and NP4)
  • Accelerated sessions on FortiView All Sessions page
  • NP session offloading in HA active-active configuration
  • Configuring NP HMAC check offloading
  • Software switch interfaces and NP processors
  • Disabling NP offloading for firewall policies
  • Disabling NP offloading for individual IPsec VPN phase 1s
  • Disabling NP offloading for unsupported IPsec encryption or authentication algorithms
  • NP acceleration, virtual clustering, and VLAN MAC addresses
  • Determining the network processors installed in your FortiGate
  • NP hardware acceleration alters packet flow
  • NP7, NP6, NP6XLite, and NP6Lite traffic logging and monitoring
  • sFlow and NetFlow and hardware acceleration
  • Checking that traffic is offloaded by NP processors
  • Dedicated management CPU
  • Preventing packet ordering problems
• Strict protocol header checking disables hardware acceleration
• NTurbo and IPSA
  • NTurbo offloads flow-based processing
  • Disabling nTurbo for firewall policies
  • IPSA offloads flow-based pattern matching
• NP7 acceleration
  • NP7 session fast path requirements
    • Mixing fast path and non-fast path traffic
    • Protocols that can be offloaded by NP7 processors
  • Viewing your FortiGate NP7 processor configuration
  • NP7 performance optimized over KR links
  • Bandwidth control for NPU accelerated VDOM link interfaces
  • Controlling the maximum outgoing VLAN bandwidth
  • Per-session accounting for offloaded NP7 sessions
    • Enabling per-session accounting
    • Enabling multicast per-session accounting
    • Changing the per-session accounting interval
  • Increasing NP7 offloading capacity using link aggregation groups (LAGs)
  • NP7 processors and redundant interfaces
  • Configuring inter-VDOM link acceleration with NP7 processors
    • Using VLANs to add more accelerated inter-VDOM links
    • Confirm that the traffic is accelerated
  • Reassembling and offloading fragmented packets
  • NP7 traffic shaping
  • Disabling offloading IPsec Diffie-Hellman key exchange
  • Access control lists (ACLs)
  • DoS policy hardware acceleration
  • Distributing HA session synchronization packets to multiple CPUs
  • Configuring NP7 processors
    • dedicated-management-cpu {disable | enable}
    • ipsec-ob-np-sel {RR | packet | hash}
    • policy-offload-level {disable | dos-offload | full-offload}
    • hash-config {src-dst-ip | 5-tuple | src-ip}
    • hash-config {src-dst-ip | src-ip}
    • ippool-overload-low
    • ippool-overload-high
    • dse-timeout
    • capwap-offload {disable | enable}
    • default-qos-type {policing | shaping}
    • gtp-support {disable | enable}
    • per-session-accounting {disable | enable | traffic-log-only}
    • session-acct-interval
    • max-session-timeout
    • mcast-session-accounting {tpe-based | session-based | disable}
    • hash-tbl-spread (disable | enable}
    • inbound-dscp-copy-port [...]
    • config port-npu-map
    • config port-path-option
    • config dos-options
    • config tcp-timeout-profile
    • config udp-timeout-profile
    • config hpe
    • config priority-protocol
    • config fp-anomaly
    • config ip-reassembly
    • config dsw-dts-profile
    • config dsw-queue-dts-profile
    • Configuring NP7 queue protocol prioritization
    • Default NP7 queue protocol prioritization configuration
  • Changing NP7 TCP session setup
  • NP7 diagnose commands
    • diagnose npu np7 (display NP7 information)
    • diagnose sys session list and no_ofld_reason field (NP7 session information)
• FortiGate NP7 architectures
  • FortiGate 1800F and 1801F fast path architecture
  • FortiGate 2600F and 2601F fast path architecture
  • FortiGate 4200F and 4201F fast path architecture
  • FortiGate 4400F and 4401F fast path architecture
  • FortiGate-7121F fast path architecture
  • FIM-7921F fast path architecture
  • FPM-7620F fast path architecture
• NP6, NP6XLite, and NP6Lite acceleration
  • NP6 session fast path requirements
  • NP6XLite processors
  • NP6Lite processors
  • NP6 processors and traffic shaping
  • NP Direct
  • Viewing your FortiGate NP6, NP6XLite, or NP6Lite processor configuration
  • Disabling NP6, NP6XLite, and NP6Lite hardware acceleration (fastpath)
  • Optimizing NP6 performance by distributing traffic to XAUI links
  • Enabling bandwidth control between the ISF and NP6 XAUI ports to reduce the number of dropped egress packets
  • Increasing NP6 offloading capacity using link aggregation groups (LAGs)
  • NP6 processors and redundant interfaces
  • Improving LAG performance on some FortiGate models
  • Eliminating dropped packets on LAG interfaces
  • Configuring inter-VDOM link acceleration with NP6 processors
    • Using VLANs to add more accelerated inter-VDOM link interfaces
    • Confirm that the traffic is accelerated
    • IPv6 IPsec VPN over NPU VDOM links
  • Disabling offloading IPsec Diffie-Hellman key exchange
  • Supporting IPsec anti-replay protection
  • Access control lists (ACLs)
  • Configuring individual NP6 processors
  • The HPE and changing BGP, SLBC, and BFD priority
  • Per-session accounting for offloaded NP6, NP6XLite, and NP6Lite sessions
  • Multicast per-session accounting
  • Configuring NP6 session timeouts
  • Configure the number of IPsec engines NP6 processors use
  • Stripping clear text padding and IPsec session ESP padding
  • Disabling NP6 and NP6XLite CAPWAP offloading
  • Optionally disable NP6 offloading of traffic passing between 10Gbps and 1Gbps interfaces
  • Offloading RDP traffic
  • NP6 session drift
  • Optimizing FortiGate 3960E and 3980E IPsec VPN performance
  • FortiGate 3960E and 3980E support for high throughput traffic streams
  • Recalculating packet checksums if the iph.reserved bit is set to 0
  • NP6 IPsec engine status monitoring
  • Interface to CPU mapping
  • Allowing offloaded IPsec packets that exceed the interface MTU
  • Configuring the QoS mode for NP6-accelerated traffic
  • Recovering from an internal link failure
  • NP6 get and diagnose commands
    • get hardware npu np6
    • diagnose npu np6
    • diagnose npu np6 npu-feature (verify enabled NP6 features)
    • diagnose npu np6xlite npu-feature (verify enabled NP6Lite features)
    • diagnose npu np6lite npu-feature (verify enabled NP6Lite features)
    • diagnose sys session/session6 list (view offloaded sessions)
    • diagnose sys session list no_ofld_reason field
    • diagnose npu np6 session-stats (number of NP6 IPv4 and IPv6 sessions)
    • diagnose npu np6 ipsec-stats (NP6 IPsec statistics)
    • diagnose npu np6 sse-stats (number of NP6 sessions and dropped sessions)
    • diagnose npu np6 dce (number of dropped NP6 packets)
    • diagnose hardware deviceinfo nic (number of packets dropped by an interface)
    • diagnose npu np6 synproxy-stats (NP6 SYN-proxied sessions and unacknowledged SYNs)
• FortiGate NP6 architectures
  • FortiGate 300D fast path architecture
  • FortiGate 300E and 301E fast path architecture
  • FortiGate 400D fast path architecture
  • FortiGate 400E and 401E fast path architecture
  • FortiGate 400E Bypass fast path architecture
  • FortiGate 500D fast path architecture
  • FortiGate 500E and 501E fast path architecture
  • FortiGate 600E and 601E fast path architecture
  • FortiGate 600D fast path architecture
  • FortiGate 800D fast path architecture
  • FortiGate 900D fast path architecture
  • FortiGate 1000D fast path architecture
  • FortiGate 1100E and 1101E fast path architecture
  • FortiGate 1200D fast path architecture
  • FortiGate 1500D fast path architecture
  • FortiGate 1500DT fast path architecture
  • FortiGate 2000E fast path architecture
  • FortiGate 2200E and 2201E fast path architecture
  • FortiGate 2500E fast path architecture
  • FortiGate 3000D fast path architecture
  • FortiGate 3100D fast path architecture
  • FortiGate 3200D fast path architecture
  • FortiGate 3300E and 3301E fast path architecture
  • FortiGate 3400E and 3401E fast path architecture
  • FortiGate 3600E and 3601E fast path architecture
  • FortiGate 3700D fast path architecture
  • FortiGate 3700DX fast path architecture
  • FortiGate 3800D fast path architecture
  • FortiGate 3810D fast path architecture
  • FortiGate 3815D fast path architecture
  • FortiGate 3960E fast path architecture
  • FortiGate 3980E fast path architecture
  • FortiGate-5001D fast path architecture
  • FortiGate-5001E and 5001E1 fast path architecture
  • FortiGate-6000 series
  • FortiController-5902D fast path architecture
  • FortiGate-7030E fast path architecture
  • FortiGate-7040E fast path architecture
  • FortiGate-7060E fast path architecture
  • FIM-7901E fast path architecture
  • FIM-7904E fast path architecture
  • FIM-7910E fast path architecture
  • FIM-7920E fast path architecture
  • FPM-7620E fast path architecture
  • FPM-7630E fast path architecture
• FortiGate NP6XLite architectures
  • FortiGate 60F and 61F fast path architecture
  • FortiGate 80F, 81F, and 80F Bypass fast path architecture
  • FortiGate 100F and 101F fast path architecture
  • FortiGate 200F and 201F fast path architecture
• FortiGate NP6Lite architectures
  • FortiGate 100E and 101E fast path architecture
  • FortiGate 200E and 201E fast path architecture
• Change log