Configuring how the internal switch fabric distributes sessions to NP7 processors
On FortiGates with multiple NP7processors, you can use the following command to configure how the internal switch fabric (ISF) distributes sessions to the NP7 processors.
config system global
config system npu
set hash-config {src-dst-ip | 5-tuple | src-ip}
end
Changing the hash-config
causes the FortiGate to restart.
src-dist-ip
, use 2-tupple source and destination IP address hashing. This option is only available on FortiGates with an odd number of NP7 processors. For example, the FortiGate-3500F and 3501F have three NP7 processors, so this is the default hash-config
for these models. On FortiGates with an odd number of NP7 processors, src-dist-ip
is the default value.
5-tuple
, the default value on FortiGates with an even number of NP7 processors. To distribute sessions, a hash is created for each session based on the session's source and destination IP address, IP protocol, and source and destination TCP/UDP port. In most cases 5-tuple
distribution provides the best performance.However, CGNAT resource quotas are distributed differently depending on the hash-config
.
src-ip
, sessions are distributed by source IP address. All sessions from a source IP address are processed by the same NP7 processor.