NP processors and IPsec anti-replay protection

IPsec Anti-replay protection protects IPsec tunnel traffic by making sure that replayed packets cannot be used to subvert tunnel security. Anti-replay protection can introduce packet reordering issues, as the very nature of anti-replay is that the right packet arrives in the correct sequence for the appropriate security control (decryption) to be applied.

NP7, NP7Lite, NP6XLite, and NP6Lite processors include a packet ordering engine that works in conjunction with IPsec functions to control anti-replay and packet ordering issues. This is inherent to the functions of these processors, and therefore IPsec anti-replay can be enabled on FortiGate models with NP7, NP7Lite, NP6XLite, and NP6Lite processors.

NP6 processors do not have an integrated packet ordering function. Each NP6 operates multiple crypto engines to provide high crypto performance, and this can cause packet ordering issues with large packet size variations. For more information, see Supporting IPsec anti-replay protection.