A new version of the hyperscale firewall policy engine was added to FortiOS 7.4.3 and 7.6.0. This new version is intended to resolve issues that cause the limitations described in Hyperscale firewall policy engine limitations and mechanics. So these limitations may no longer apply. This new versions is relatively new and more testing needs to be done to determine if there are new limitations. The limitation of 15,000 policies per hyperscale VDOM has not been changed.

New section: Overload PBA resource quota limitation.

If your FortiGate has multiple NP7 processors, depending on whether or not you are enabling EIF in hyperscale firewall policies, you may want to use the nss-threads-option of the config system npu command to optimize performance, see nss-threads-option {4T-EIF | 4T-NOEIF | 2T}.

You should not operate DoS protection in monitor mode on a FortiGate licensed for hyperscale firewall, for more information in this limitation, see Hyperscale firewall 7.4.4 incompatibilities and limitations.

Added more information about limitations of the diagnose sys npu-session list command output when host logging is enabled, see Displaying information about NP7 hyperscale firewall hardware sessions.

More corrections to the information in this document about ALG support.

Removed incorrect information about ALG support requiring hash-config set to src-ip.

New section: Overload PBA port-reuse limitation for traffic between a single source and destination IP address. Changes to Recommended NP7 traffic distribution for optimal CGNAT performance.

Corrections to SNMP information in Hyperscale firewall policy MIB fields. Removed content about SNMP queries for NAT46 and NAT64 policy statistics, since SNMP fields for NAT46 and NAT64 policies have been removed from the Fortinet MIB.

If you have set up a threat feed as the source or destination address in a hyperscale firewall policy, you cannot enable the corresponding address negate option (dstaddr-negate or srcaddr-negate), see Adding IP address threat feeds to hyperscale firewall policies.

Corrected information about firewall VIP support for hyperscale firewall VDOMs in Hyperscale firewall 7.4.4 incompatibilities and limitations.

New section Configuring NP7 processors describes all of the options of the config system npu command available on FortiGates licensed for Hyperscale firewall.

Changes to Recommended NP7 traffic distribution for optimal CGNAT performance. New section Carrier-Grade NAT Architecture Guide. Per-session hardware logging is not compatible with session-count DoS anomalies, see Hyperscale firewall 7.4.4 incompatibilities and limitations for more information.

New section: Removing the hyperscale firewall license.

Improvements to the information in the following sections to add more details and make the available information more accessible:

• Hardware accelerated Carrier Grade NAT.

• Hardware logging.

New section: Hyperscale and standard FortiOS CGNAT feature comparison .

Added information about hardware logging sending multiple session start log messages if log-processor is set to hardware and log-mode is set to per-session to Hyperscale firewall 7.4.4 incompatibilities and limitations.