Fortinet Document Library

Version:

Version:

Version:

Version:

Version:


Table of Contents

Hardware Acceleration

NP6 HPE configuration options

The NP6 HPE supports setting individual limits for the following traffic types:

  • TCP SYN

  • TCP SYN_ACK

  • TCP FIN and RST

  • TCP

  • UDP

  • ICMP

  • SCTP

  • ESP

  • Fragmented IP packets

  • Other types of IP packets

  • ARP

  • Other layer-2 packets that are not ARP packets

The following table lists and describes the HPE options for each traffic type.

Option Description Default
enable-shaper {disable | enable} Enable or disable the HPE for the current NP6 processor. disable
tcpsyn-max Limit the maximum number of TCP SYN packets received per second per host queue. The range is 1000 to 1000000000 pps. 600000
tcpsyn-ack-max

Prevent SYN_ACK reflection attacks by limiting the number of TCP SYN_ACK packets received per second per host queue. The range is 1000 to 1000000000 pps. TCP SYN_ACK reflection attacks consist of an attacker sending large amounts of SYN_ACK packets without first sending SYN packets. These attacks can cause high CPU usage because the firewall assumes that these SYN_ACK packets are the first packets in a session, so the packets are processed by the CPU instead of the NP6 processor.

600000

tcpfin-rst-max

Limit the maximum number of TCP FIN and RST packets received per second per host queue. The range is 1000 to 1000000000 pps.

600000

tcp-max Limit the maximum number of TCP packets received per second per host queue that are not filtered by tcpsyn-max, tcpsyn-ack-max, or tcpfin-rst-max.

The range is 1000 to 1000000000 pps.

600000
udp-max Limit the maximum number of UDP packets received per second per host queue. The range is 1000 to 1000000000 pps. 600000
icmp-max Limit the maximum number of ICMP packets received per second per host queue. The range is 1000 to 1000000000 pps. 200000
sctp-max Limit the maximum number of SCTP packets received per second per host queue. The range is 1000 to 1000000000 pps. 200000
esp-max Limit the maximum number of ESP packets received per second per host queue. The range is 1000 to 1000000000 pps. 200000
ip-frag-max Limit the maximum number of fragmented IP packets received per second per host queue. The range is 1000 to 1000000000 pps. 200000
ip-others-max Limit the maximum number of other types of IP packets received per second per host queue. Other packet types are IP packets that cannot be set with other HPE options. The range is 1000 to 1000000000 pps. 200000
arp-max Limit the maximum number of ARP packets received per second per host queue. The range is 1000 to 1000000000 pps. 200000
l2-others-max Limit the maximum number of other layer-2 packets that are not ARP packets received per second per host queue. The range is 1000 to 1000000000 pps. This option limits HA heartbeat, HA session sync, LACP/802.3ad, FortiSwitch heartbeat, and wireless-controller CAPWAP packets. 200000

NP6 HPE configuration options

The NP6 HPE supports setting individual limits for the following traffic types:

  • TCP SYN

  • TCP SYN_ACK

  • TCP FIN and RST

  • TCP

  • UDP

  • ICMP

  • SCTP

  • ESP

  • Fragmented IP packets

  • Other types of IP packets

  • ARP

  • Other layer-2 packets that are not ARP packets

The following table lists and describes the HPE options for each traffic type.

Option Description Default
enable-shaper {disable | enable} Enable or disable the HPE for the current NP6 processor. disable
tcpsyn-max Limit the maximum number of TCP SYN packets received per second per host queue. The range is 1000 to 1000000000 pps. 600000
tcpsyn-ack-max

Prevent SYN_ACK reflection attacks by limiting the number of TCP SYN_ACK packets received per second per host queue. The range is 1000 to 1000000000 pps. TCP SYN_ACK reflection attacks consist of an attacker sending large amounts of SYN_ACK packets without first sending SYN packets. These attacks can cause high CPU usage because the firewall assumes that these SYN_ACK packets are the first packets in a session, so the packets are processed by the CPU instead of the NP6 processor.

600000

tcpfin-rst-max

Limit the maximum number of TCP FIN and RST packets received per second per host queue. The range is 1000 to 1000000000 pps.

600000

tcp-max Limit the maximum number of TCP packets received per second per host queue that are not filtered by tcpsyn-max, tcpsyn-ack-max, or tcpfin-rst-max.

The range is 1000 to 1000000000 pps.

600000
udp-max Limit the maximum number of UDP packets received per second per host queue. The range is 1000 to 1000000000 pps. 600000
icmp-max Limit the maximum number of ICMP packets received per second per host queue. The range is 1000 to 1000000000 pps. 200000
sctp-max Limit the maximum number of SCTP packets received per second per host queue. The range is 1000 to 1000000000 pps. 200000
esp-max Limit the maximum number of ESP packets received per second per host queue. The range is 1000 to 1000000000 pps. 200000
ip-frag-max Limit the maximum number of fragmented IP packets received per second per host queue. The range is 1000 to 1000000000 pps. 200000
ip-others-max Limit the maximum number of other types of IP packets received per second per host queue. Other packet types are IP packets that cannot be set with other HPE options. The range is 1000 to 1000000000 pps. 200000
arp-max Limit the maximum number of ARP packets received per second per host queue. The range is 1000 to 1000000000 pps. 200000
l2-others-max Limit the maximum number of other layer-2 packets that are not ARP packets received per second per host queue. The range is 1000 to 1000000000 pps. This option limits HA heartbeat, HA session sync, LACP/802.3ad, FortiSwitch heartbeat, and wireless-controller CAPWAP packets. 200000