Session quotas for IPv4 sessions

You can use the following options to control the number of sessions accepted by firewall policies with NAT disabled that can be created by an individual client IPv4 address. This quota applies to the total number of NP7-offloaded hardware sessions and software sessions. The IPv4 session quota is a global quota, not a per-firewall policy quota. This limit can be useful for preventing single IPv4 clients from consuming excessive amounts of bandwidth.

In firewall policies with NAT enabled, you can use the firewall policy CGN session quota (cgn-session-quota) option to limit the number of sessions per IPv4 address allowed by that policy. For more information, see CGN resource allocation hyperscale firewall policies.

config system npu

set ipv4-session-quota {disable | enable}

set ipv4-session-quota-high <high-threshold>

set ipv4-session-quota-low <low-threshold>

end

ipv4-prefix-session-quota enable or disable setting a high and low quota for the number of sessions accepted by firewall policies with NAT disabled that a client with an IPv4 address can create. This option is disabled by default.

ipv4-prefix-session-quota-high the high IPv4 session threshold. Any IPv4 client can start a maximum of this number of sessions. If the threshold is exceeded, all new sessions from that client are blocked until their session count is reduced to below the ipv4-prefix-session-quota-low threshold. The default high threshold is 1073741823.

ipv4-prefix-session-quota-low the low IPv4 session threshold. The default low threshold is 536870911.

IPv4 session quotas use a session table created and maintained in software by the CPU. To create this session table you need to enable host logging (see Global hardware logging settings). With host logging enabled, NP7 processors send session information to the CPU, which maintains a session table of NP7 sessions and software sessions in software and system memory. This session table is checked to see if IPv4 session quotas are exceeded.

You do not need to enable logging in hyperscale firewall polices to support IPv4 session quotas. Enabling host logging can reduce overall FortiGate performance because the FortiGate CPUs manage the session table and perform hardware logging instead of offloading logging to the NP7 processors.

Diagnose command

You can use the following diagnose command to view IPv4 session quota information:

diagnose npu np7 ipv4-session-quota {list | stat | clear}