config icmp-error-rate-ctrl

ICMP error rate control limits the average number of ICMP error packets generated by NP7 processors and includes a token bucket system to limit ICMPv4 and ICMPv6 error packet bursts.

Under some high-traffic conditions, NP7 processors can generate excessive amounts of ICMP error packets. Because ICMP error packets are processed by the CPU, without rate limiting, excessive amounts of ICMP error packets can cause high CPU usage and possibly CPU stalling.

ICMP error rate control is enabled by default. If your FortiGate CPU performance is being affected by excessive ICMP error traffic, you can use the following options to change the average packet generation rates and adjust the token bucket size for ICMPv4 and ICMPv6 error packets. You can also disable ICMP error rate control.

config system npu

config icmp-error-rate-ctrl

set icmpv4-error-rate-limit {disable | enable}

set icmpv4-error-rate <packets-per-second>

set icmpv4-error-bucket-size <token-bucket-size>

set icmpv6-error-rate-limit {disable | enable}

set icmpv6-error-rate <packets-per-second>

set icmpv6-error-bucket-size <token-bucket-size>

end

icmpv4-error-rate-limit enable or disable ICMPv4 error packet rate limiting. Enabled by default.

icmpv4-error-rate the average number of ICMPv4 error packets that can be generated per second. The range is 1 to 100 and the default rate is 1 packet per second.

icmpv4-error-bucket-size the bucket size used in the token bucket algorithm for controlling the flow of ICMPv4 error packets to prevent packet bursts. The range is 1 to 100 packets and the default is 20 packets.

icmpv6-error-rate-limit enable or disable ICMPv6 error packet rate limiting. Enabled by default.

icmpv6-error-rate the average number of ICMPv6 error packets that can be generated per second. The range is 1 to 100 and the default rate is 1 packet per second.

icmp-v6-error-bucket-size the bucket size used by the token bucket algorithm for controlling the flow of ICMPv6 error packets to prevent packet bursts. The range is 1 to 100 packets and the default is 20 packets.