NP processors and packet ordering under heavy load

In some cases when FortiGate units with NP7, NP7Lite, NP6, NP6XLite, or NP6Lite processors are under heavy load, the packets of some sessions may be transmitted by the FortiGate in the wrong order, resulting in the TCP sessions failing or causing packets to be re-transmitted.

NP7, NP7Lite, NP6XLite, and NP6Lite processors include a packet ordering engine that prevents packet ordering issues. So packet ordering issues are much less common on FortiGates with NP7, NP7Lite, NP6XLite, and NP6Lite processors than on FortiGates with NP6 processors.

If you notice TCP sessions failing when a FortiGate with NP7, NP7Lite, NP6, NP6XLite, or NP6ite processors is very busy you can enable delay-tcp-npu-session in the firewall policy receiving the traffic. This option resolves the problem by delaying the session to make sure that there is time for all of the handshake packets to reach the destination before the session begins transmitting data.

config firewall policy

set delay-tcp-npu-session enable

end

You can also use the following command to prevent packet ordering problems for all traffic.

config system global

set delay-tcp-npu-session enable

end

This is a global option that applies to all traffic and overrides the per-policy setting.

NP6 processors are limited in how they handle burst traffic packet ordering problems. Some additional options are available to reduce packet ordering problems on FortiGates with NP6 possessors see, Supporting IPsec anti-replay protection.