Updated NP7 session fast path requirements to include GRE. Corrections to hash-config {src-dst-ip | 5-tuple | src-ip}.

New section: FortiGate 40F fast path architecture.

Changes to NTurbo offloads flow-based processing.

New section: Performance reduction for NP6 processors with 1Gbps interfaces.

Changes to:

• diagnose sys session list and no_ofld_reason field (NP7 session information).

• Changes to NP7 traffic shaping.

• qtm-buf-mode {6ch | 4ch}.

Changes to the following sections:

• NP7 access control lists (ACLs).

• NP6 access control lists (ACLs).

New sections FortiGate Rugged 60F fast path architecture. Changes to most FortiGate fast path architecture descriptions.

Updates to NP7 performance optimized over KR links.

Changes to the following sections to correct information related to the SOC4:

• NP6XLite processors.

• FortiGate 60F and 61F fast path architecture.

• FortiGate 80F, 81F, and 80F Bypass fast path architecture.

• FortiGate 100F and 101F fast path architecture.

Corrections to FortiGate NP7 architecture interface speeds, see FortiGate NP7 architectures.

Changes to FortiGate 3960E fast path architecture and FortiGate 3980E fast path architecture to explain that in multi-ISF systems, such as the FortiGate 3860E and FortiGate 3890E, NP6 offloading is not supported for LAGs containing interfaces connected to different ISF switches.

The following fast path architecture sections have been added:

• FortiGate-7121F fast path architecture.

• FIM-7921F fast path architecture.

• FIM-7941F fast path architecture.

• FPM-7620F fast path architecture.

• FortiGate-7030E fast path architecture.

• FortiGate-7040E fast path architecture.

• FortiGate-7060E fast path architecture.

• FPM-7620E fast path architecture.

• FPM-7630E fast path architecture.

• FIM-7901E fast path architecture.

• FIM-7904E fast path architecture.

• FIM-7910E fast path architecture.

• FIM-7920E fast path architecture.

Misc. changes throughout the document.

FortiOS 6.4.14 document release.

FortiOS 6.4.13 document release.

Added a note explaining that enabling or disabling np6-cps-optimization-mode requires a system restart. You should only change this setting during a maintenance window or quiet period. The note was added to the following sections:

• Improving FortiGate 1200D connections per second performance.

• Improving FortiGate 1500D connections per second performance.

• Improving FortiGate 1500DT connections per second performance.

Virtual network enabler (VNE) tunnel sessions are not offloaded by NP6 or NP6Lite (SOC3) processors. VNE tunnel sessions are offloaded by NP6XLite processors. Added a note about this to NP6 session fast path requirements.

Corrections and improvements to config port-path-option.

New sections:

• NP7 packet sniffer.

• Tracing packet flow on FortiGates with NP7 processors.

• hw-ha-scan-interval <interval>.

Added information about splitting interfaces to:

• FortiGate 1800F and 1801F fast path architecture.

• FortiGate 2600F and 2601F fast path architecture.

FortiOS 6.4.12 document release.

Added all relevant options and corrected the information about the NP7 hash-config option, see hash-config {src-dst-ip | 5-tuple | src-ip}.

Deleted an incorrect statement about NP7 support for SSL VPN encryption from Network processors (NP7, NP6, NP6XLite, and NP6Lite).

Corrected information about NTurbo support and interface policies, see NTurbo offloads flow-based processing.

New section: Tunneling protocols that can be offloaded by NP7 processors.

Corrected the documented default values for many of the individual traffic types monitored by NP7 HPE, see NP7 HPE for individual traffic types.

New sections:

• ull-port-mode {10G | 25G} .

• FortiGate 400F and 401F fast path architecture.

• FortiGate 600F and 601F fast path architecture.

FortiOS 6.4.11 document release.

Corrections to FortiGate-5001E and 5001E1 fast path architecture.

Corrections to the information in the table in DoS policy hardware acceleration.

Added a disclaimer to CP9, CP9XLite, and CP9Lite capabilities.

FortiOS 6.4.10 document release. New information about NP7 DoS policy offloading limitations added to DoS policy hardware acceleration.

Changes to the following sections:

• FortiGate 4200F and 4201F fast path architecture.

• FortiGate 4400F and 4401F fast path architecture.

• hash-config {src-dst-ip | 5-tuple | src-ip}.

• Per-session accounting for offloaded NP6, NP6XLite, and NP6Lite sessions.

New section: NP6 HPE host protection engine.

Improvements to Configuring hyperscale TCP timeout profiles and Configuring hyperscale UDP timeout profiles.

Fixes to NTurbo and IPSA and IPSA offloads flow-based pattern matching. More information about NP7 traffic shaping added to NP7 traffic shaping.

Changes to config dsw-queue-dts-profile.

Previous versions of this document incorrectly stated that NP6 processors support offloading DoS policy sessions. This has been corrected throughout the document as required.

FortiOS 6.4.9 document release. See What's new for FortiGates with NP7 processors for FortiOS 6.4.9. New section: diagnose sys session list and no_ofld_reason field (NP7 session information).

New sections:

• Allowing offloaded IPsec packets that exceed the interface MTU.

• FortiGate 400E Bypass fast path architecture.

• diagnose sys session list no_ofld_reason field.

Added information about NP6 processor support of DoS protection and offloading DoS policies. Changes to NP7 Host Protection Engine (HPE).

Renamed the section: Configuring NP7 queue protocol prioritization. New section Default NP7 queue protocol prioritization configuration. Correction to Disabling NP offloading for firewall policies and Disabling nTurbo for firewall policies.

Corrected the default setting and added more information to vlan-lookup-cache {disable | enable}.

Updated the following sections to correct information about interface groups and to add information about splitting interfaces:

• FortiGate 4200F and 4201F fast path architecture.

• FortiGate 4400F and 4401F fast path architecture.

Moved information about improving CPS performance to sections describing the following FortiGate models that support this feature:

• FortiGate 1200D fast path architecture.

• FortiGate 1500D fast path architecture.

• FortiGate 1500DT fast path architecture.

Removed information about older NP and CP processors and removed information about SP processors since older FortiGate models that include this hardware are not supported by FortiOS 6.4.

Corrections to FortiGate 80F, 81F, and 80F Bypass fast path architecture.

Changes to policy-offload-level {disable | dos-offload | full-offload}.

Correction to Disabling NP offloading for firewall policies.

New section Disabling nTurbo for firewall policies.

Removed the incorrect section "Disabling CP offloading for firewall policies".

FortiOS 6.4.8 document release. See What's new for FortiGates with NP7 processors for FortiOS 6.4.8.

More information added to NP6 session drift.

Added more information about the NP6XLite processor to Network processors (NP7, NP6, NP6XLite, and NP6Lite) and NP6XLite processors. This content continues to be under development. If you have comments about it, contact techdoc@fortinet.com.

Updates to the following sections:

• FortiGate 1800F and 1801F fast path architecture.

• FortiGate 2600F and 2601F fast path architecture.

• FortiGate 4200F and 4201F fast path architecture.

• FortiGate 4400F and 4401F fast path architecture.

New and improved content:

• Re-wrote the information about the NP7 HPE, see NP7 Host Protection Engine (HPE).

• New section: NP acceleration, virtual clustering, and VLAN MAC addresses.

• Fixes to NP6 session drift.

• Removed the information about CP9 support for a true random number generator and entropy source from CP9, CP9XLite, and CP9Lite capabilities.

Updated NTurbo offloads flow-based processing to clarify that NTurbo also applies to IPsec VPN sessions.

Corrected errors in the section FortiGate 100F and 101F fast path architecture.

FortiOS 6.4.6 document release. FortiOS 6.4.6 includes support for FortiGates with NP7 processors and for NP7 hyperscale firewall features. See What's new for FortiGates with NP7 processors for FortiOS 6.4.6.

Updated NP6 session fast path requirements to list support for offloading UDP traffic with a destination port of 4500 (ESP-in-UDP traffic). New section: Offloading UDP-encapsulated ESP traffic.

Added a note about NP6 processors not offloading sessions between two EMAC VLANs on NPU inter-VDOM link interfaces to Using VLANs to add more accelerated inter-VDOM link interfaces.

Corrected integrated switch fabric information in the following sections:

• FortiGate 300E and 301E fast path architecture.

• FortiGate 400E and 401E fast path architecture.

• FortiGate 500E and 501E fast path architecture.

• FortiGate 600E and 601E fast path architecture.

Added more information about bypass mode to:

• FortiGate 800D fast path architecture.

• FortiGate 2500E fast path architecture.

• FortiGate 80F, 81F, and 80F Bypass fast path architecture.

Improved the information in Supporting IPsec anti-replay protection.

Corrected the output of the get hardware npu np6 port-list command in FortiGate 3600E and 3601E fast path architecture.

Corrected the get hardware npu np6 port-list command output in FortiGate 1100E and 1101E fast path architecture.

Updated the architecture sections for most E and F models to include more information about management/HA and data processing separation. For example, see the following:

• FortiGate 400E and 401E fast path architecture.

• FortiGate 1100E and 1101E fast path architecture.

• FortiGate 3300E and 3301E fast path architecture

• FortiGate 200F and 201F fast path architecture.

• FortiGate 200E and 201E fast path architecture.

New section: FortiGate 200F and 201F fast path architecture.

New section: FortiGate 80F, 81F, and 80F Bypass fast path architecture. More information about NetFlow support added to sFlow and NetFlow and hardware acceleration. Corrected the get hardware npu np6 port-list command output in FortiGate 1100E and 1101E fast path architecture.

More information and corrections about SOC4 (NP6XLite and CP9XLite) and SOC3 (NP6Lite and CP9Lite).

• Network processors (NP7, NP6, NP6XLite, and NP6Lite).

• NP6XLite processors.

• NP6Lite processors.

• Content processors (CP9, CP9XLite, CP9Lite).

• FortiGate 60F and 61F fast path architecture.

• FortiGate 100F and 101F fast path architecture.

• FortiGate 100E and 101E fast path architecture.

• FortiGate 200E and 201E fast path architecture.

Added bypass interface information to FortiGate 800D fast path architecture. Minor improvements to the bypass interface information in FortiGate 2500E fast path architecture. Other misc. changes and fixes.

Improved information about how for NP7 and many more recent NP6 fast path architectures the HA interfaces are not connected to the NP7 or NP6 processors. Information about bypass mode added to FortiGate 2500E fast path architecture. Corrected the output of the diagnose npu np6 port-list command in FortiGate 3960E fast path architecture.

Hardware architectures changed:

• FortiGate 500E and 501E fast path architecture.
• FortiGate 600E and 601E fast path architecture.

New section: FortiGate 100E and 101E fast path architecture.

Added a note about NP6 processors and traffic shaping counters to NP6 processors and traffic shaping.

Information about setting interface speeds added to FortiGate 3400E and 3401E fast path architecture and FortiGate 3600E and 3601E fast path architecture.

Added NP6XLite content.

Corrected the get hardware npu np6 port-list output in FortiGate 3400E and 3401E fast path architecture.

Added information about interface groups for the following models:

• FortiGate 1100E and 1101E fast path architecture.
• FortiGate 2200E and 2201E fast path architecture.
• FortiGate 3400E and 3401E fast path architecture.
• FortiGate 3600E and 3601E fast path architecture.

Added a note about ESP in UDP sessions (UDP port 4500) not been offloaded by NP6 processors to NP6 session fast path requirements.

Corrections to Dedicated management CPU.

Changes to Disabling NP6, NP6XLite, and NP6Lite hardware acceleration (fastpath).

New sections:

• FortiGate 1100E and 1101E fast path architecture.
• FortiGate 2200E and 2201E fast path architecture.
• FortiGate 3300E and 3301E fast path architecture.

Improvements to the information about the HPE in Configuring individual NP6 processors.

New sections:

• Adjusting NP6 HPE BGP, SLBC, and BFD priorities.
• Eliminating dropped packets on LAG interfaces.