IPsec support for round robin and RPS distribution 7.0.8

FortiOS supports round robin mode and Receive Packet Steering (RPS) on the IPsec interface. IPsec round robin enables encrypted packets to be processed across multiple CPUs, whereas packet redistribution enables decrypted packets to be processed across multiple CPUs. Round-robin and RPS redistribution are independent of each other, enabling users to choose one or both methods as needed, per their requirements. Both round robin and RPS distribution are disabled by default.

These features ensure that encrypted and decrypted IPsec packets are evenly distributed across all available CPUs.

To enable/disable round robin redistribution to multiple CPUs for IPsec VPN traffic:

config system global
    set ipsec-round-robin {enable | disable}
end

To enable/disable RPS on the IPsec interface:

config vpn ipsec phase1-interface
    edit <name>
        set packet-redistribution {enable | disable}
    next
end