Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:


Table of Contents

Hardware Acceleration

NP7 HPE for individual traffic types

If you want to set different maximum packet rates for different packet types, you can disable all-protocol by setting it 0. When you do this, the NP7 HPE supports setting individual limits for the following traffic types:

  • TCP SYN

  • TCP SYN_ACK

  • TCP FIN and RST

  • TCP

  • UDP

  • ICMP

  • SCTP

  • ESP

  • Fragmented IP packets

  • Other types of IP packets

  • ARP

  • Other layer-2 packets that are not ARP packets

The following table lists and describes the HPE options for individual traffic types.

Option Description Default
tcpsyn-max Limit the maximum number of TCP SYN packets received per second per host queue. The range is 1000 to 40000000 pps. 40000

tcpsyn-ack-max

Prevent SYN_ACK reflection attacks by limiting the number of TCP SYN_ACK packets received per second per host queue. The range is 1000 to 40000000 pps. TCP SYN_ACK reflection attacks consist of an attacker sending large amounts of SYN_ACK packets without first sending SYN packets. These attacks can cause high CPU usage because the firewall assumes that these SYN_ACK packets are the first packets in a session, so the packets are processed by the CPU instead of the NP7 processors. The range is 1000 to 40000000 pps.

40000

tcpfin-rst-max

Limit the maximum number of TCP FIN and RST packets received per second per host queue. The range is 1000 to 40000000 pps.

40000

tcp-max Limit the maximum number of TCP packets received per second per host queue that are not filtered by tcpsyn-max, tcpsyn-ack-max, or tcpfin-rst-max. The range is 1000 to 40000000 pps. 40000
udp-max Limit the maximum number of UDP packets received per second per host queue. The range is 1000 to 40000000 pps. 40000
icmp-max Limit the maximum number of ICMP packets received per second per host queue. The range is 1000 to 40000000 pps. 20000
sctp-max Limit the maximum number of SCTP packets received per second per host queue. The range is 1000 to 40000000 pps. 20000
esp-max Limit the maximum number of ESP packets received per second per host queue. The range is 1000 to 40000000 pps. 20000
ip-frag-max Limit the maximum number of fragmented IP packets received per second per host queue. The range is 1000 to 40000000 pps. 20000
ip-others-max Limit the maximum number of other types of IP packets received per second per host queue. Other packet types are IP packets that cannot be set with other HPE options. The range is 1000 to 40000000 pps. 20000
arp-max Limit the maximum number of ARP packets received per second per host queue. The range is 1000 to 40000000 pps. 20000
l2-others-max Limit the maximum number of other layer-2 packets that are not ARP packets received per second per host queue. The range is 1000 to 40000000 pps. This option limits HA heartbeat, HA session sync, LACP/802.3ad, FortiSwitch heartbeat, and wireless-controller CAPWAP packets. 20000

NP7 HPE for individual traffic types

If you want to set different maximum packet rates for different packet types, you can disable all-protocol by setting it 0. When you do this, the NP7 HPE supports setting individual limits for the following traffic types:

  • TCP SYN

  • TCP SYN_ACK

  • TCP FIN and RST

  • TCP

  • UDP

  • ICMP

  • SCTP

  • ESP

  • Fragmented IP packets

  • Other types of IP packets

  • ARP

  • Other layer-2 packets that are not ARP packets

The following table lists and describes the HPE options for individual traffic types.

Option Description Default
tcpsyn-max Limit the maximum number of TCP SYN packets received per second per host queue. The range is 1000 to 40000000 pps. 40000

tcpsyn-ack-max

Prevent SYN_ACK reflection attacks by limiting the number of TCP SYN_ACK packets received per second per host queue. The range is 1000 to 40000000 pps. TCP SYN_ACK reflection attacks consist of an attacker sending large amounts of SYN_ACK packets without first sending SYN packets. These attacks can cause high CPU usage because the firewall assumes that these SYN_ACK packets are the first packets in a session, so the packets are processed by the CPU instead of the NP7 processors. The range is 1000 to 40000000 pps.

40000

tcpfin-rst-max

Limit the maximum number of TCP FIN and RST packets received per second per host queue. The range is 1000 to 40000000 pps.

40000

tcp-max Limit the maximum number of TCP packets received per second per host queue that are not filtered by tcpsyn-max, tcpsyn-ack-max, or tcpfin-rst-max. The range is 1000 to 40000000 pps. 40000
udp-max Limit the maximum number of UDP packets received per second per host queue. The range is 1000 to 40000000 pps. 40000
icmp-max Limit the maximum number of ICMP packets received per second per host queue. The range is 1000 to 40000000 pps. 20000
sctp-max Limit the maximum number of SCTP packets received per second per host queue. The range is 1000 to 40000000 pps. 20000
esp-max Limit the maximum number of ESP packets received per second per host queue. The range is 1000 to 40000000 pps. 20000
ip-frag-max Limit the maximum number of fragmented IP packets received per second per host queue. The range is 1000 to 40000000 pps. 20000
ip-others-max Limit the maximum number of other types of IP packets received per second per host queue. Other packet types are IP packets that cannot be set with other HPE options. The range is 1000 to 40000000 pps. 20000
arp-max Limit the maximum number of ARP packets received per second per host queue. The range is 1000 to 40000000 pps. 20000
l2-others-max Limit the maximum number of other layer-2 packets that are not ARP packets received per second per host queue. The range is 1000 to 40000000 pps. This option limits HA heartbeat, HA session sync, LACP/802.3ad, FortiSwitch heartbeat, and wireless-controller CAPWAP packets. 20000