Virtual network enabler (VNE) tunnel sessions are not offloaded by NP6 or NP6Lite (SOC3) processors. VNE tunnel sessions are offloaded by NP6XLite processors. Added a note about this to NP6 session fast path requirements.

New section: FortiGate 70F and 71F fast path architecture.

Corrections and improvements to config port-path-option.

New sections:

• NP7 packet sniffer.

• Tracing packet flow on FortiGates with NP7 processors.

• hw-ha-scan-interval <interval>.

Added information about splitting interfaces to:

• FortiGate 1000F and 1001F fast path architecture.

• FortiGate 1800F and 1801F fast path architecture.

• FortiGate 2600F and 2601F fast path architecture.

• FortiGate 3000F and 3001F fast path architecture.

• FortiGate 3500F and 3501F fast path architecture.

Added all relevant options and corrected the information about the NP7 hash-config option, see hash-config {src-dst-ip | 5-tuple | src-ip}. Added a note about setting the hash-config for the FortiGate-3500F and 3501F to FortiGate 3500F and 3501F fast path architecture.

Deleted an incorrect statement about NP7 support for SSL VPN encryption from Network processors (NP7, NP6, NP6XLite, and NP6Lite).

The dedicated management CPU feature is supported by the FortiGates with the NP6XLite (SOC4) processor. This information has been added to Improving GUI and CLI responsiveness (dedicated management CPU).

Corrected information about NTurbo support and interface policies, see NTurbo offloads flow-based processing.

New section: Tunneling protocols that can be offloaded by NP7 processors.

Corrected the documented default values for many of the individual traffic types monitored by NP7 HPE, see NP7 HPE for individual traffic types.

New sections:

• FortiGate 400F and 401F fast path architecture.

• FortiGate 600F and 601F fast path architecture.

• FortiGate 1000F and 1001F fast path architecture.

• FortiGate 3000F and 3001F fast path architecture.

• ull-port-mode {10G | 25G} .

FortiOS 7.0.9 document release.

Described support for creating LAGs between interfaces connected to different NP6 processors for FortiGates with multiple NP6 processors and no internal switch fabric. For more information, see Increasing NP6 offloading capacity using link aggregation groups (LAGs).

The following FortiGate models support this feature and the sections linked below have been updated with this information:

• FortiGate 200E and 201E fast path architecture.

• FortiGate 900D fast path architecture.

• FortiGate 1000D fast path architecture.

• FortiGate 2000E fast path architecture.

• FortiGate 2500E fast path architecture.

FortiOS 7.0.8 document release.

FortiOS 7.0.7 document release. Corrections to FortiGate-5001E and 5001E1 fast path architecture.

New information about NP7 DoS policy offloading limitations added to DoS policy hardware acceleration.

Added a disclaimer to CP9 capabilities.

Changes to the following sections:

• FortiGate 4200F and 4201F fast path architecture.

• FortiGate 4400F and 4401F fast path architecture.

• hash-config {src-dst-ip | 5-tuple | src-ip}.

• Per-session accounting for offloaded NP6, NP6XLite, and NP6Lite sessions.

Improvements to Configuring hyperscale TCP timeout profiles and Configuring hyperscale UDP timeout profiles.

More information about NP7 traffic shaping added to NP7 traffic shaping. Fixes to NTurbo and IPSA and IPSA offloads flow-based pattern matching.

FortiOS 7.0.6 Document release. For new features, see What's new in FortiOS 7.0.6.

Changes to config dsw-queue-dts-profile. New section: diagnose sys session list and no_ofld_reason field (NP7 session information).

Previous versions of this document incorrectly stated that NP6 processors support offloading DoS policy sessions. This has been corrected throughout the document as required. New section FortiGate 200F and 201F fast path architecture.

Corrections to FortiGate 400E Bypass fast path architecture.

New section: FortiGate 400E Bypass fast path architecture.

FortiOS 7.0.5 Document release. For new features, see What's new in FortiOS 7.0.5.

New sections:

• Allowing offloaded IPsec packets that exceed the interface MTU.

• Offloading traffic denied by a firewall policy to reduce CPU usage.

Removed an incorrect statement from the section Increasing NP6 offloading capacity using link aggregation groups (LAGs).

Correction to Disabling NP offloading for firewall policies and Disabling nTurbo for firewall policies.

Moved information about improving CPS performance to sections describing the following FortiGate models that support this feature:

• FortiGate 1200D fast path architecture.

• FortiGate 1500D fast path architecture.

• FortiGate 1500DT fast path architecture.

Removed information about older NP and CP processors and removed information about SP processors since older FortiGate models that include this hardware are not supported by FortiOS 6.4.

Corrections to FortiGate 80F, 81F, and 80F Bypass fast path architecture.

Correction to Disabling NP offloading for firewall policies.

New section Disabling nTurbo for firewall policies.

Removed the incorrect section "Disabling CP offloading for firewall policies".

More information added to NP6 session drift.

New section: FortiGate 80F, 81F, and 80F Bypass fast path architecture.

Added more information about the NP6XLite processor to Network processors (NP7, NP6, NP6XLite, and NP6Lite) and NP6XLite processors.

New and improved content:

• Re-wrote the information about the NP6 HPE, see: NP6 HPE host protection engine.

• New section: NP acceleration, virtual clustering, and VLAN MAC addresses.

• Fixes to NP6 session drift.

• Removed the information about CP9 support for a true random number generator and entropy source from CP9 capabilities.

Corrected errors in the section FortiGate 100F and 101F fast path architecture.

FortiOS 7.0.1 document release. For new features, see What's new in FortiOS 7.0.1.

Added a note about NP6 processors not offloading sessions between two EMAC VLANs on NPU inter-VDOM link interfaces to Using VLANs to add more accelerated inter-VDOM link interfaces.

Updated NTurbo offloads flow-based processing to clarify that NTurbo also applies to IPsec VPN sessions.

Updated NP6 session fast path requirements to list support for offloading UDP traffic with a destination port of 4500 (ESP-in-UDP traffic). New section: Offloading UDP-encapsulated ESP traffic.

Corrected integrated switch fabric information in the following sections:

• FortiGate 300E and 301E fast path architecture.

• FortiGate 400E and 401E fast path architecture.

• FortiGate 500E and 501E fast path architecture.

• FortiGate 600E and 601E fast path architecture.

Improved the information in Supporting IPsec anti-replay protection.

Corrected the output of the get hardware npu np6 port-list command in FortiGate 3600E and 3601E fast path architecture.