New sections:

• Allowing offloaded IPsec packets that exceed the interface MTU.

• Offloading traffic denied by a firewall policy to reduce CPU usage.

• diagnose sys session list no_ofld_reason field.

Previous versions of this document incorrectly stated that NP6 processors support offloading DoS policy sessions. This has been corrected throughout the document as required.

Changes to the HPE section of NP6 HPE host protection engine.

Removed an incorrect statement from the section Increasing NP6 offloading capacity using link aggregation groups (LAGs).

Correction to Disabling NP offloading for firewall policies and Disabling nTurbo for firewall policies.

Moved information about improving CPS performance to sections describing the following FortiGate models that support this feature:

• FortiGate 1200D fast path architecture.

• FortiGate 1500D fast path architecture.

• FortiGate 1500DT fast path architecture.

Removed information about older NP and CP processors and removed information about SP processors since older FortiGate models that include this hardware are not supported by FortiOS 7.0.

Correction to Disabling NP offloading for firewall policies.

New section Disabling nTurbo for firewall policies.

Removed the incorrect section "Disabling CP offloading for firewall policies".

Added more information about the NP6XLite processor to Network processors (NP6, NP6XLite, and NP6Lite) and NP6XLite processors.

New and improved content:

• Re-wrote the information about the NP6 HPE, see: NP6 HPE host protection engine.

New section: NP acceleration, virtual clustering, and VLAN MAC addresses. Fixes to NP6 session drift. Removed the information about CP9 support for a true random number generator and entropy source from CP9 capabilities.

Added a note about NP6 processors not offloading sessions between two EMAC VLANs on NPU inter-VDOM link interfaces to Using VLANs to add more accelerated inter-VDOM link interfaces.

Updated NTurbo offloads flow-based processing to clarify that NTurbo also applies to IPsec VPN sessions.

Corrected errors in the section FortiGate 100F and 101F fast path architecture.

Updated NP6 session fast path requirements to list support for offloading UDP traffic with a destination port of 4500 (ESP-in-UDP traffic). New section: Offloading UDP-encapsulated ESP traffic.

Corrected integrated switch fabric information in the following sections:

• FortiGate 300E and 301E fast path architecture.

• FortiGate 400E and 401E fast path architecture.

• FortiGate 500E and 501E fast path architecture.

• FortiGate 600E and 601E fast path architecture.

Improved the information in Supporting IPsec anti-replay protection.

Corrected the output of the get hardware npu np6 port-list command in FortiGate 3600E and 3601E fast path architecture.