How the NP7 hash-config affects sessions that require session helpers or ALGs

On FortiGates with multiple NP7processors, you can use the following command to configure how the internal switch fabric (ISF) distributes sessions to the NP7 processors.

config system global

config system npu

set hash-config {5-tuple | src-ip}

end

Changing the hash-config causes the FortiGate to restart.

5-tuple, the default. To distribute sessions a hash is created for each session based on the session's source and destination IP address, IP protocol, and source and destination TCP/UDP port. In most cases 5-tuple distribution provides the best performance.

src-ip, sessions are distributed by source IP address. All sessions from a source IP address are processed by the same NP7 processor.

Setting hash-config to src-ip is required to offload traffic that requires session helpers or application layer gateways (ALGs) (for example, FTP, TFTP, SIP, MGCP, H.323, PPTP, L2TP, ICMP Error/IP-options, PMAP, TNS, DCE-RPC, RAS, and RSH).

On a FortiGae with hyperscale firewall features enabled, session helper and ALG traffic should be processed by normal VDOMs and not by hyperscale firewall VDOMs. Traffic that requires session helpers or ALGs is not compatible with hyperscale firewall functionality since the initial packets of a new session must be processed by the CPU. As well, some traffic that requires ALGs, for example SIP traffic, also requires a security profile and security profiles are not compatible with hyperscale firewall functionality.

Session helper and ALG traffic can be partially offloaded by NP7 processors. For example, SIP setup sessions are processed by the CPU, but the RTP and RTCP sessions that result from SIP setup sessions can be accelerated by NP7 processors.