List hardware session setup sessions

Use the diagnose sys npu-session command to view hardware session information. The following commands are available:

• Use the diagnose sys npu-session list {44 | 46 | host} command to list IPv4 hardware sessions, NAT46 hardware sessions, or host IPv4 sessions. Host IPv4 sessions are IPv4 sessions that have not been offloaded.
• Use the diagnose sys npu-session list6 {66 | 64 | host} command to list IPv6 hardware sessions, NAT64 hardware sessions, or host IPv6 sessions. Host IPv6 sessions are IPv6 sessions that have not been offloaded.
• Use the diagnose sys npu-session filter {filter-options} command to filter the sessions that you list or clear. You can use filter-options to display or clear sessions from specific VDOMs, display sessions for specific policy IDs, to specific source and destination addresses, and so on. Use the CLI help to list all of the options available.
• Use the diagnose sys npu-session stat verbose {44 | 66 | 64 | 46} command to view details about IPv4, IPv6, NAT64, and NAT46 sessions. The information displayed includes session counts, the number of SNAT, DNAT and dual NAT sessions, and so on. If you use diagnose sys npu-session filter to create a filter, the filter is also applied to the output of the diagnose sys npu-session stat verbose command for IPv4 and IPv6 sessions. Using the verbose option scans the SSEs of all available NP7 processors in the FortiGate and sends this data to the CPU. On a busy system processing a large number of hardware sessions, this process can send a very large number of messages that may overrun the messaging driver. As a result, the verbose output may show lower than expected session counts. This problem is expected to be addressed in future releases.

You can also use diagnose sys session list and diagnose sys session6 list to list sessions that have not been offloaded.

For example, to list IPv4 hardware sessions enter:

diagnose sys npu-session list 44
session info: proto=6 proto_state=01 duration=64721 expire=0 timeout=3600 flags=00000000 sockflag=00000000 sockport=0 av_idx=0 use=1
origin-shaper=
reply-shaper=
per_ip_shaper=
class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=255/255
state=new f18 
statistic(bytes/packets/allow_err): org=3620/40/0 reply=0/0/0 tuples=2
tx speed(Bps/kbps): 0/0 rx speed(Bps/kbps): 0/0
orgin->sink: org pre->post, reply pre->post dev=22->23/0->0 gwy=10.100.200.1/10.160.21.191
hook=post dir=org act=snat 192.168.10.12:49698->52.230.222.68:443(10.3.3.5:5128)
hook=pre dir=reply act=dnat 52.230.222.68:443->10.3.3.5:5128(192.168.10.12:49698)
pos/(before,after) 0/(0,0), 0/(0,0)
misc=0 policy_id=0 auth_info=0 chk_client_info=0 vd=0
serial=000163ff tos=ff/ff app_list=0 app=0 url_cat=0
rpdb_link_id = 00000000 ngfwid=n/a
dd_type=0 dd_mode=0
  setup by offloaded-policy: origin=native
  O: npid=255/0, in: OID=76/VID=0, out: NHI=77/VID=0
  R: npid=0/0, in: OID=0/VID=0, out: NHI=0/VID=0

To show stats for IPv4 sessions after adding an IPv4 filter:

diagnose sys npu-session stat verbose 44
misc info: session_count=10000 tcp_session_count=10000 udp_session_count=0
        snat_count=10000 dnat_count=0 dual_nat_count=0
        3T_hit_count=0 accounting_enabled_count=0
TCP sessions:
         10000 in ESTABLISHED state
Session filter:
        vd: 2
        sintf: 10
        proto: 6-6
        3 filters