NP6 HPE configuration options
The NP6 HPE supports setting individual limits for the following traffic types:
-
TCP SYN
-
TCP SYN_ACK
-
TCP FIN and RST
-
TCP
-
UDP
-
ICMP
-
SCTP
-
ESP
-
Fragmented IP packets
-
Other types of IP packets
-
ARP
-
Other layer-2 packets that are not ARP packets
The following table lists and describes the HPE options for each traffic type.
| Option | Description | Default |
|---|---|---|
enable-shaper {disable | enable}
|
Enable or disable the HPE for the current NP6 processor. | disable |
tcpsyn-max
|
Limit the maximum number of TCP SYN packets received per second per host queue. The range is 1000 to 1000000000 pps. | 600000 |
tcpsyn-ack-max
|
Prevent SYN_ACK reflection attacks by limiting the number of TCP SYN_ACK packets received per second per host queue. The range is 1000 to 1000000000 pps. TCP SYN_ACK reflection attacks consist of an attacker sending large amounts of SYN_ACK packets without first sending SYN packets. These attacks can cause high CPU usage because the firewall assumes that these SYN_ACK packets are the first packets in a session, so the packets are processed by the CPU instead of the NP6 processor. |
600000 |
tcpfin-rst-max
|
Limit the maximum number of TCP FIN and RST packets received per second per host queue. The range is 1000 to 1000000000 pps. |
600000 |
tcp-max
|
Limit the maximum number of TCP packets received per second per host queue that are not filtered by tcpsyn-max, tcpsyn-ack-max, or tcpfin-rst-max. The range is 1000 to 1000000000 pps. |
600000 |
udp-max
|
Limit the maximum number of UDP packets received per second per host queue. The range is 1000 to 1000000000 pps. | 600000 |
icmp-max
|
Limit the maximum number of ICMP packets received per second per host queue. The range is 1000 to 1000000000 pps. | 200000 |
sctp-max
|
Limit the maximum number of SCTP packets received per second per host queue. The range is 1000 to 1000000000 pps. | 200000 |
esp-max
|
Limit the maximum number of ESP packets received per second per host queue. The range is 1000 to 1000000000 pps. | 200000 |
ip-frag-max
|
Limit the maximum number of fragmented IP packets received per second per host queue. The range is 1000 to 1000000000 pps. | 200000 |
ip-others-max
|
Limit the maximum number of other types of IP packets received per second per host queue. Other packet types are IP packets that cannot be set with other HPE options. The range is 1000 to 1000000000 pps. | 200000 |
arp-max
|
Limit the maximum number of ARP packets received per second per host queue. The range is 1000 to 1000000000 pps. | 200000 |
l2-others-max
|
Limit the maximum number of other layer-2 packets that are not ARP packets received per second per host queue. The range is 1000 to 1000000000 pps. This option limits HA heartbeat, HA session sync, LACP/802.3ad, FortiSwitch heartbeat, and wireless-controller CAPWAP packets. | 200000 |