Displaying information about NP7 hyperscale firewall hardware sessions
Use the diagnose sys npu-session command to view NP7 hardware sessions as well as sessions that are not offloaded to NP7 processors. You can list and clear NP7 hardware sessions and create filters to control the sessions that are listed or cleared.
|
You can also use |
diagnose sys npu-session list [{44 | 46}]
List IPv4 NP7 hardware sessions or sessions not offloaded to NP7 processors. If you have set up an IPv4 filter, this command lists sessions that match the IPv4 filter.
This command displays the current session list stored in the logging buffer. If Hyperscale SPU Offload Log Settings is set to Hardware (or the config log npu-server option log-processor is set to hardware), the logging buffer includes all session details.
If Hyperscale SPU Offload Log Settings is set to Host (or the config log npu-server option log-processor is set to host), the command displays fewer details about the session list, because CPU or host logging only maintains a subset of all of the information available for each session in the session list. For example, the CPU or host logging session table includes the default session timeout information for each session. This session timeout value may not be accurate for some sessions. The actual session timeout is available from the session list maintained by the NP7 Session Search Engine (SSE) session table. To see the actual session timeout for NP7 sessions, you must use the diagnose sys npu-session list-full command.
(no options) list IPv4 and NAT46 NP7 sessions.
44 list IPv4 NP7 sessions.
46 list NAT46 NP7 sessions.
host list IPv4 sessions that have not been offloaded to NP7 processors.
diagnose sys npu-session list6 [{66 | 64}]
List IPv6 NP7 hardware sessions or sessions that have not been offloaded to NP7 processors. If you have set up an IPv6 filter, this command lists sessions that match the IPv6 filter.
This command displays the current session list stored in the logging buffer. If Hyperscale SPU Offload Log Settings is set to Hardware (or the config log npu-server option log-processor is set to hardware), the logging buffer includes all session details.
If Hyperscale SPU Offload Log Settings is set to Host (or the config log npu-server option log-processor is set to host), the command displays fewer details about the session list, because CPU or host logging only maintains a subset of all of the information available for each session in the session list. For example, the CPU or host logging session table includes the default session timeout information for each session. This session timeout value may not be accurate for some sessions. The actual session timeout is available from the session list maintained by the NP7 Session Search Engine (SSE) session table. To see the actual session timeout for NP7 sessions, you must use the diagnose sys npu-session list-full command.
(no options) list IPv6 and NAT64 NP7 sessions.
66 list IPv6 NP7 sessions.
64 list NAT64 NP7 sessions.
host list IPv6 sessions that have not been offloaded to NP7 processors.
diagnose sys npu-session list-full [{44 | 46}]
List IPv4 NP7 hardware sessions and include more information about each session than that provided by the list option. If you have set up an IPv4 filter, this command lists sessions that match the IPv4 filter.
This command displays the current IPv4 NP7 hyperscale firewall hardware session list by sending a query to the NP7 Session Search Engine (SSE). The output does not depend on the hardware logging configuration because the command queries the SSE. However, because the commands are querying the SSE, the response time will be longer.
(no options) list IPv4 and NAT46 NP7 sessions.
44 list IPv4 NP7 sessions.
46 list NAT46 NP7 sessions.
diagnose sys npu-session list-full6 [{66 | 64}]
List IPv6 NP7 hardware sessions and include more information about each session than that provided by the list6 option. If you have set up an IPv6 filter, this command lists sessions that match the IPv4 filter.
This command displays the current IPv6 NP7 hyperscale firewall hardware session list by sending a query to the NP7 SSE. The output does not depend on the hardware logging configuration because the command queries the SSE. However, because the commands are querying the SSE, the response time will be longer.
(no options) list IPv6 and NAT64 NP7 sessions.
66 list IPv6 NP7 sessions.
64 list NAT64 NP7 sessions.
diagnose sys npu-session list-brief [{44 | 46}]
View summary information about IPv4 sessions offloaded to NP7 processors.
The command output includes lists of sessions organized by session type and a total number of sessions for each session type. Summary information for each session includes the protocol, expiry time, source and destination addresses, and source and destination NAT addresses.
diagnose sys npu-session list-brief6 [{66 | 64}]
View summary information about IPv6 sessions offloaded to NP7 processors.
The command output includes lists of sessions organized by session type and a total number of sessions for each session type. Summary information for each session includes the protocol, expiry time, source and destination addresses, and source and destination NAT addresses.
diagnose sys npu-session clear [{44 | 46}]
Clear (delete) IPv4 NP7 hardware sessions or sessions that have not been offloaded to NP7 processors. If you have set up an IPv4 filter, this command clears sessions that match the IPv4 filter.
(no options) clear IPv4 and NAT46 NP7 sessions.
44 clear IPv4 NP7 sessions.
46 clear NAT46 NP7 sessions.
host clear IPv4 sessions that have not been offloaded to NP7 processors.
diagnose sys npu-session clear6 [{66 | 64}]
Clear (delete) IPv6 hardware sessions or sessions that have not been offloaded to NP7 processors. If you have set up an IPv6 filter, this command clears sessions that match the IPv6 filter.
(no options) clear IPv6 and NAT64 NP7 sessions.
66 clear IPv6 NP7 sessions.
64 clear NAT64 NP7 sessions.
host clear IPv6 sessions that have not been offloaded to NP7 processors.
diagnose sys npu-session stat [verbose [{44 | 66 | 64 | 46}]]
View summary information about NP7 hardware sessions and hardware logging.
(no options) show the NP7 hardware session count, the hardware session setup rate, and some log rates.
verbose [{44 | 66 | 64 | 46}]] show more information about NP7 hardware sessions. Use the additional options to display more detailed information for a subset of the NP7 hardware sessions. Stats are also displayed for each session. If you have set up filters, information is displayed for sessions that match the filters.
Using the verbose option scans the SSEs of all available NP7 processors in the FortiGate and sends this data to the CPU. On a busy system processing a large number of hardware sessions, this process can send a very large number of messages that may overrun the messaging driver. As a result, the verbose output may show lower than expected session counts. This problem is expected to be addressed in future releases.
diagnose sys npu-session purge
Clear all NP7 hardware sessions.
diagnose sys npu-session filter {filter-options}
Filter the IPv4 sessions that you list or clear. You can use filter-options to display or clear sessions from specific VDOMs, display sessions for specific policy IDs, to specific source and destination addresses, and so on. Use the CLI help to list all of the options available. Use the clear option to clear the IPv4 filter. Use the negate option to create an inverse filter.
diagnose sys npu-session filter6 {filter-options}
Filter the IPv6 sessions that you list or clear. You can use filter-options to display or clear sessions from specific VDOMs, display sessions for specific policy IDs, to specific source and destination addresses, and so on. Use the CLI help to list all of the options available. Use the clear option to clear the IPv6 filter. Use the negate option to create an inverse filter.
Examples
To list IPv4 NP7 hardware sessions enter:
diagnose sys npu-session list 44 session info: proto=6 proto_state=01 duration=64721 expire=0 timeout=3600 flags=00000000 sockflag=00000000 sockport=0 av_idx=0 use=1 origin-shaper= reply-shaper= per_ip_shaper= class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=255/255 state=new f18 statistic(bytes/packets/allow_err): org=3620/40/0 reply=0/0/0 tuples=2 tx speed(Bps/kbps): 0/0 rx speed(Bps/kbps): 0/0 orgin->sink: org pre->post, reply pre->post dev=22->23/0->0 gwy=10.100.200.1/10.160.21.191 hook=post dir=org act=snat 192.168.10.12:49698->52.230.222.68:443(10.3.3.5:5128) hook=pre dir=reply act=dnat 52.230.222.68:443->10.3.3.5:5128(192.168.10.12:49698) pos/(before,after) 0/(0,0), 0/(0,0) misc=0 policy_id=0 auth_info=0 chk_client_info=0 vd=0 serial=000163ff tos=ff/ff app_list=0 app=0 url_cat=0 rpdb_link_id = 00000000 ngfwid=n/a dd_type=0 dd_mode=0 setup by offloaded-policy: origin=native O: npid=255/0, in: OID=76/VID=0, out: NHI=77/VID=0 R: npid=0/0, in: OID=0/VID=0, out: NHI=0/VID=0
To show stats for IPv4 NP7 hardware sessions after adding an IPv4 filter:
diagnose sys npu-session stat verbose 44
misc info: session_count=10000 tcp_session_count=10000 udp_session_count=0
snat_count=10000 dnat_count=0 dual_nat_count=0
3T_hit_count=0 accounting_enabled_count=0
TCP sessions:
10000 in ESTABLISHED state
Session filter:
vd: 2
sintf: 10
proto: 6-6
3 filters