NP7 HPE for individual traffic types
If you want to set different maximum packet rates for different packet types, you can disable all-protocol by setting it 0. When you do this, the NP7 HPE supports setting individual limits for the following traffic types:
-
TCP SYN
-
TCP SYN_ACK
-
TCP FIN and RST
-
TCP
-
UDP
-
ICMP
-
SCTP
-
ESP
-
Fragmented IP packets
-
Other types of IP packets
-
ARP
-
Other layer-2 packets that are not ARP packets
The following table lists and describes the HPE options for individual traffic types.
| Option | Description | Default |
|---|---|---|
tcpsyn-max
|
Limit the maximum number of TCP SYN packets received per second per host queue. The range is 1000 to 40000000 pps. | 40000 |
|
|
Prevent SYN_ACK reflection attacks by limiting the number of TCP SYN_ACK packets received per second per host queue. The range is 1000 to 40000000 pps. TCP SYN_ACK reflection attacks consist of an attacker sending large amounts of SYN_ACK packets without first sending SYN packets. These attacks can cause high CPU usage because the firewall assumes that these SYN_ACK packets are the first packets in a session, so the packets are processed by the CPU instead of the NP7 processors. The range is 1000 to 40000000 pps. |
40000 |
|
|
Limit the maximum number of TCP FIN and RST packets received per second per host queue. The range is 1000 to 40000000 pps. |
40000 |
tcp-max
|
Limit the maximum number of TCP packets received per second per host queue that are not filtered by tcpsyn-max, tcpsyn-ack-max, or tcpfin-rst-max. The range is 1000 to 40000000 pps. |
40000 |
udp-max
|
Limit the maximum number of UDP packets received per second per host queue. The range is 1000 to 40000000 pps. | 40000 |
icmp-max
|
Limit the maximum number of ICMP packets received per second per host queue. The range is 1000 to 40000000 pps. | 5000 |
sctp-max
|
Limit the maximum number of SCTP packets received per second per host queue. The range is 1000 to 40000000 pps. | 5000 |
esp-max
|
Limit the maximum number of ESP packets received per second per host queue. The range is 1000 to 40000000 pps. | 5000 |
ip-frag-max
|
Limit the maximum number of fragmented IP packets received per second per host queue. The range is 1000 to 40000000 pps. | 5000 |
ip-others-max
|
Limit the maximum number of other types of IP packets received per second per host queue. Other packet types are IP packets that cannot be set with other HPE options. The range is 1000 to 40000000 pps. | 5000 |
arp-max
|
Limit the maximum number of ARP packets received per second per host queue. The range is 1000 to 40000000 pps. | 5000 |
l2-others-max
|
Limit the maximum number of other layer-2 packets that are not ARP packets received per second per host queue. The range is 1000 to 40000000 pps. This option limits HA heartbeat, HA session sync, LACP/802.3ad, FortiSwitch heartbeat, and wireless-controller CAPWAP packets. | 5000 |