FortiOS 7.0.0 added support for creating LAGs between interfaces connected to different NP6 processors for FortiGates with multiple NP6 processors and no internal switch fabric. For more information, see Increasing NP6 offloading capacity using link aggregation groups (LAGs).

The following FortiGate models support this feature and the sections linked below have been updated with this information:

• FortiGate 200E and 201E fast path architecture.

• FortiGate 900D fast path architecture.

• FortiGate 1000D fast path architecture.

• FortiGate 2000E fast path architecture.

• FortiGate 2500E fast path architecture.

New sections:

• FortiGate 1000F and 1001F fast path architecture.

• ull-port-mode {10G | 25G} .

Corrections to FortiGate-5001E and 5001E1 fast path architecture.

New information about NP7 DoS policy offloading limitations added to DoS policy hardware acceleration.

Added a disclaimer to CP9 capabilities.

Changes to the following sections:

• FortiGate 4200F and 4201F fast path architecture.

• FortiGate 4400F and 4401F fast path architecture.

• hash-config {5-tuple | src-ip}.

• Per-session accounting for offloaded NP6, NP6XLite, and NP6Lite sessions.

Improvements to Configuring hyperscale TCP timeout profiles and Configuring hyperscale UDP timeout profiles.

New section: FortiGate 3700F and 3701F fast path architecture. More information about NP7 traffic shaping added to NP7 traffic shaping. Fixes to NTurbo and IPSA and IPSA offloads flow-based pattern matching.

FortiOS 7.0.6 Document release. For new features, see What's new in FortiOS 7.0.6.

Changes to config dsw-queue-dts-profile. New section: diagnose sys session list and no_ofld_reason field (NP7 session information).

Previous versions of this document incorrectly stated that NP6 processors support offloading DoS policy sessions. This has been corrected throughout the document as required. New section FortiGate 200F and 201F fast path architecture.

Corrections to FortiGate 400E Bypass fast path architecture.

New section: FortiGate 400E Bypass fast path architecture.

FortiOS 7.0.5 Document release. For new features, see What's new in FortiOS 7.0.5.

New sections:

• Allowing offloaded IPsec packets that exceed the interface MTU.

• Offloading traffic denied by a firewall policy to reduce CPU usage.

Removed an incorrect statement from the section Increasing NP6 offloading capacity using link aggregation groups (LAGs).

Correction to Disabling NP offloading for firewall policies and Disabling nTurbo for firewall policies.

Moved information about improving CPS performance to sections describing the following FortiGate models that support this feature:

• FortiGate 1200D fast path architecture.

• FortiGate 1500D fast path architecture.

• FortiGate 1500DT fast path architecture.

Removed information about older NP and CP processors and removed information about SP processors since older FortiGate models that include this hardware are not supported by FortiOS 6.4.

Corrections to FortiGate 80F, 81F, and 80F Bypass fast path architecture.

Correction to Disabling NP offloading for firewall policies.

New section Disabling nTurbo for firewall policies.

Removed the incorrect section "Disabling CP offloading for firewall policies".

More information added to NP6 session drift.

New section: FortiGate 80F, 81F, and 80F Bypass fast path architecture.

Added more information about the NP6XLite processor to Network processors (NP7, NP6, NP6XLite, and NP6Lite) and NP6XLite processors.

New and improved content:

• Re-wrote the information about the NP6 HPE, see: NP6 HPE host protection engine.

• New section: NP acceleration, virtual clustering, and VLAN MAC addresses.

• Fixes to NP6 session drift.

• Removed the information about CP9 support for a true random number generator and entropy source from CP9 capabilities.

Corrected errors in the section FortiGate 100F and 101F fast path architecture.

FortiOS 7.0.1 document release. For new features, see What's new in FortiOS 7.0.1.

Added a note about NP6 processors not offloading sessions between two EMAC VLANs on NPU inter-VDOM link interfaces to Using VLANs to add more accelerated inter-VDOM link interfaces.

Updated NTurbo offloads flow-based processing to clarify that NTurbo also applies to IPsec VPN sessions.

Updated NP6 session fast path requirements to list support for offloading UDP traffic with a destination port of 4500 (ESP-in-UDP traffic). New section: Offloading UDP-encapsulated ESP traffic.

Corrected integrated switch fabric information in the following sections:

• FortiGate 300E and 301E fast path architecture.

• FortiGate 400E and 401E fast path architecture.

• FortiGate 500E and 501E fast path architecture.

• FortiGate 600E and 601E fast path architecture.

Improved the information in Supporting IPsec anti-replay protection.

Corrected the output of the get hardware npu np6 port-list command in FortiGate 3600E and 3601E fast path architecture.