Session quotas for IPv6 sessions

You can use the following options to control the number of client sessions that can be created per IPv6 /64 prefix. This quota applies to the total number of NP7-offloaded hardware sessions and software sessions. For example, if your organization assigns an /64 prefix to each IPv6 client, you can limit the number of IPv6 sessions from each IPv6 client that will be accepted by the FortiGate. The IPv6 session quota is a global quota, not a per-firewall policy quota. This limit can be useful for preventing single clients from consuming excessive amounts of bandwidth.

config system npu

set ipv6-prefix-session-quota {disable | enable}

set ipv6-prefix-session-quota-high <threshold>

set ipv6-prefix-session-quota-low <threshold>

end

ipv6-prefix-session-quota enable or disable the IPv6 session quota. This option is disabled by default. When enabled you can set high and low quota thresholds.

ipv6-prefix-session-quota-high the high IPv6 session threshold. Any IPv6 client can start a maximum of this number of sessions. If the threshold is exceeded, all new sessions from that client are blocked until their session count is reduced to below the ipv6-prefix-session-quota-low threshold. The default high threshold is 1073741823.

ipv6-prefix-session-quota-low the low IPv6 session threshold. The default low threshold is 536870911.

IPv6 session quotas use a session table created and maintained in software by the CPU. To create this session table you need to enable host logging (see Global hardware logging settings). With host logging enabled, NP7 processors send session information to the CPU, which maintains a session table of NP7 sessions and software sessions in software and in system memory. This session table is checked to see if IPv6 session quotas are exceeded.

You do not need to enable logging in hyperscale firewall polices to support IPv6 session quotas. Enabling host logging can reduce overall FortiGate performance because the FortiGate CPUs manage the session table and perform hardware logging instead of offloading logging to the NP7 processors.

Diagnose command

You can use the following diagnose command to view IPv6 session quota information:

diagnose npu np7 ipv6-session-quota {list | stat | clear}