config system np6xlite

This command is available for model(s): FortiGate 100F, FortiGate 101F, FortiGate 40F 3G4G, FortiGate 40F, FortiGate 60F, FortiGate 61F, FortiGate 80F Bypass, FortiGate 80F-POE, FortiGate 80F, FortiGate 81F-POE, FortiGate 81F, FortiGateRugged 60F 3G4G, FortiGateRugged 60F, FortiWiFi 40F 3G4G, FortiWiFi 40F, FortiWiFi 60F, FortiWiFi 61F, FortiWiFi 80F 2R, FortiWiFi 81F 2R-POE, FortiWiFi 81F 2R.

It is not available for: FortiGate 1000D, FortiGate 100D, FortiGate 100EF, FortiGate 100E, FortiGate 101E, FortiGate 1100E, FortiGate 1101E, FortiGate 1200D, FortiGate 140D-POE, FortiGate 140D, FortiGate 140E-POE, FortiGate 140E, FortiGate 1500DT, FortiGate 1500D, FortiGate 2000E, FortiGate 200E, FortiGate 201E, FortiGate 2200E, FortiGate 2201E, FortiGate 2500E, FortiGate 3000D, FortiGate 300D, FortiGate 300E, FortiGate 301E, FortiGate 30E 3G4G GBL, FortiGate 30E 3G4G INTL, FortiGate 30E 3G4G NAM, FortiGate 30E, FortiGate 3100D, FortiGate 3200D, FortiGate 3300E, FortiGate 3301E, FortiGate 3400E, FortiGate 3401E, FortiGate 3600E, FortiGate 3601E, FortiGate 3700D, FortiGate 3800D, FortiGate 3810D, FortiGate 3815D, FortiGate 3960E, FortiGate 3980E, FortiGate 400D, FortiGate 400E Bypass, FortiGate 400E, FortiGate 401E, FortiGate 5001D, FortiGate 5001E1, FortiGate 5001E, FortiGate 500D, FortiGate 500E, FortiGate 501E, FortiGate 50E, FortiGate 51E, FortiGate 52E, FortiGate 600D, FortiGate 600E, FortiGate 601E, FortiGate 60E-POE, FortiGate 60E, FortiGate 61E, FortiGate 800D, FortiGate 80E-POE, FortiGate 80E, FortiGate 81E-POE, FortiGate 81E, FortiGate 900D, FortiGate 90E, FortiGate 91E, FortiGate 92D, FortiGate VM64, FortiGateRugged 30D, FortiGateRugged 90D, FortiWiFi 30E 3G4G INTL, FortiWiFi 30E 3G4G NAM, FortiWiFi 30E, FortiWiFi 50E 2R, FortiWiFi 50E, FortiWiFi 51E, FortiWiFi 60E, FortiWiFi 61E.

Configure NP6XLITE attributes.

config system np6xlite
    Description: Configure NP6XLITE attributes.
    edit <name>
        set asicdos [disable|enable]
        set fastpath [disable|enable]
        config fp-anomaly
            Description: NP6XLITE IPv4 anomaly protection. trap-to-host forwards anomaly sessions to the CPU.
            set tcp-syn-fin [allow|drop|...]
            set tcp-fin-noack [allow|drop|...]
            set tcp-fin-only [allow|drop|...]
            set tcp-no-flag [allow|drop|...]
            set tcp-syn-data [allow|drop|...]
            set tcp-winnuke [allow|drop|...]
            set tcp-land [allow|drop|...]
            set udp-land [allow|drop|...]
            set icmp-land [allow|drop|...]
            set icmp-frag [allow|drop|...]
            set ipv4-land [allow|drop|...]
            set ipv4-proto-err [allow|drop|...]
            set ipv4-unknopt [allow|drop|...]
            set ipv4-optrr [allow|drop|...]
            set ipv4-optssrr [allow|drop|...]
            set ipv4-optlsrr [allow|drop|...]
            set ipv4-optstream [allow|drop|...]
            set ipv4-optsecurity [allow|drop|...]
            set ipv4-opttimestamp [allow|drop|...]
            set ipv4-csum-err [drop|trap-to-host]
            set tcp-csum-err [drop|trap-to-host]
            set udp-csum-err [drop|trap-to-host]
            set icmp-csum-err [drop|trap-to-host]
            set ipv6-land [allow|drop|...]
            set ipv6-proto-err [allow|drop|...]
            set ipv6-unknopt [allow|drop|...]
            set ipv6-saddr-err [allow|drop|...]
            set ipv6-daddr-err [allow|drop|...]
            set ipv6-optralert [allow|drop|...]
            set ipv6-optjumbo [allow|drop|...]
            set ipv6-opttunnel [allow|drop|...]
            set ipv6-opthomeaddr [allow|drop|...]
            set ipv6-optnsap [allow|drop|...]
            set ipv6-optendpid [allow|drop|...]
            set ipv6-optinvld [allow|drop|...]
        end
        set garbage-session-collector [disable|enable]
        config hpe
            Description: HPE configuration.
            set tcpsyn-max {integer}
            set tcp-max {integer}
            set udp-max {integer}
            set icmp-max {integer}
            set sctp-max {integer}
            set esp-max {integer}
            set ip-frag-max {integer}
            set ip-others-max {integer}
            set arp-max {integer}
            set l2-others-max {integer}
            set enable-shaper [disable|enable]
        end
        set ipsec-inner-fragment [disable|enable]
        set per-session-accounting [disable|traffic-log-only|...]
        set session-collector-interval {integer}
        set session-timeout-fixed [disable|enable]
        set session-timeout-interval {integer}
        set session-timeout-random-range {integer}
    next
end

config system np6xlite

Parameter

Description

Type

Size

asicdos *

Enable/disable NP6XLITE DoS offloading.

option

Option	Description
disable	Disable NP6XLITE DoS offloading (DoS done by host).
enable	Enable NP6XLITE DoS offloading (DoS done by asic).

fastpath

Enable/disable NP4 or NP6XLITE offloading (also called fast path).

option

Option	Description
disable	Disable NP4 or NP6XLITE offloading (fast path).
enable	Enable NP4 or NP6XLITE offloading (fast path).

garbage-session-collector

Enable/disable garbage session collector.

option

Option	Description
disable	Disable garbage session collector.
enable	Enable garbage session collector.

ipsec-inner-fragment

Enable/disable NP6XLite IPsec fragmentation type: inner.

option

Option	Description
disable	NP6XLite ipsec fragmentation type: outer.
enable	Enable NP6XLite ipsec fragmentation type: inner.

name

Device Name.

string

Maximum length: 31

per-session-accounting

Enable/disable per-session accounting.

option

Option	Description
disable	Disable per-session accounting.
traffic-log-only	Per-session accounting only for sessions with traffic logging enabled in firewall policy.
enable	Per-session accounting for all sessions.

session-collector-interval

Set garbage session collection cleanup interval.

integer

Minimum value: 1 Maximum value: 100

session-timeout-fixed

Enable/disable fixed timeout interval mode.

option

Option	Description
disable	Disable NPU session timeout at fixed interval.
enable	Enable NPU session timeout at fixed interval.

session-timeout-interval

Set session timeout interval.

integer

Minimum value: 0 Maximum value: 1000

session-timeout-random-range

Set the randomization range.

integer

Minimum value: 0 Maximum value: 1000

* This parameter may not exist in some models.

config fp-anomaly

Parameter

Description

Type

Size

tcp-syn-fin

TCP SYN flood SYN/FIN flag set anomalies.

option

Option	Description
allow	Allow TCP packets with syn_fin flag set to pass.
drop	Drop TCP packets with syn_fin flag set.
trap-to-host	Forward TCP packets with syn_fin flag set to FortiOS.

tcp-fin-noack

TCP SYN flood with FIN flag set without ACK setting anomalies.

option

Option	Description
allow	Allow TCP packets with FIN flag set without ack setting to pass.
drop	Drop TCP packets with FIN flag set without ack setting.
trap-to-host	Forward TCP packets with FIN flag set without ack setting to FortiOS.

tcp-fin-only

TCP SYN flood with only FIN flag set anomalies.

option

Option	Description
allow	Allow TCP packets with FIN flag set only to pass.
drop	Drop TCP packets with FIN flag set only.
trap-to-host	Forward TCP packets with FIN flag set only to FortiOS.

tcp-no-flag

TCP SYN flood with no flag set anomalies.

option

Option	Description
allow	Allow TCP packets without flag set to pass.
drop	Drop TCP packets without flag set.
trap-to-host	Forward TCP packets without flag set to FortiOS.

tcp-syn-data

TCP SYN flood packets with data anomalies.

option

Option	Description
allow	Allow TCP syn packets with data to pass.
drop	Drop TCP syn packets with data.
trap-to-host	Forward TCP syn packets with data to FortiOS.

tcp-winnuke

TCP WinNuke anomalies.

option

Option	Description
allow	Allow TCP packets winnuke attack to pass.
drop	Drop TCP packets winnuke attack.
trap-to-host	Forward TCP packets winnuke attack to FortiOS.

tcp-land

TCP land anomalies.

option

Option	Description
allow	Allow TCP land attack to pass.
drop	Drop TCP land attack.
trap-to-host	Forward TCP land attack to FortiOS.

udp-land

UDP land anomalies.

option

Option	Description
allow	Allow UDP land attack to pass.
drop	Drop UDP land attack.
trap-to-host	Forward UDP land attack to FortiOS.

icmp-land

ICMP land anomalies.

option

Option	Description
allow	Allow ICMP land attack to pass.
drop	Drop ICMP land attack.
trap-to-host	Forward ICMP land attack to FortiOS.

icmp-frag

Layer 3 fragmented packets that could be part of layer 4 ICMP anomalies.

option

Option	Description
allow	Allow L3 fragment packet with L4 protocol as ICMP attack to pass.
drop	Drop L3 fragment packet with L4 protocol as ICMP attack.
trap-to-host	Forward L3 fragment packet with L4 protocol as ICMP attack to FortiOS.

ipv4-land

Land anomalies.

option

Option	Description
allow	Allow IPv4 land attack to pass.
drop	Drop IPv4 land attack.
trap-to-host	Forward IPv4 land attack to FortiOS.

ipv4-proto-err

Invalid layer 4 protocol anomalies.

option

Option	Description
allow	Allow IPv4 invalid L4 protocol to pass.
drop	Drop IPv4 invalid L4 protocol.
trap-to-host	Forward IPv4 invalid L4 protocol to FortiOS.

ipv4-unknopt

Unknown option anomalies.

option

Option	Description
allow	Allow IPv4 with unknown options to pass.
drop	Drop IPv4 with unknown options.
trap-to-host	Forward IPv4 with unknown options to FortiOS.

ipv4-optrr

Record route option anomalies.

option

Option	Description
allow	Allow IPv4 with record route option to pass.
drop	Drop IPv4 with record route option.
trap-to-host	Forward IPv4 with record route option to FortiOS.

ipv4-optssrr

Strict source record route option anomalies.

option

Option	Description
allow	Allow IPv4 with strict source record route option to pass.
drop	Drop IPv4 with strict source record route option.
trap-to-host	Forward IPv4 with strict source record route option to FortiOS.

ipv4-optlsrr

Loose source record route option anomalies.

option

Option	Description
allow	Allow IPv4 with loose source record route option to pass.
drop	Drop IPv4 with loose source record route option.
trap-to-host	Forward IPv4 with loose source record route option to FortiOS.

ipv4-optstream

Stream option anomalies.

option

Option	Description
allow	Allow IPv4 with stream option to pass.
drop	Drop IPv4 with stream option.
trap-to-host	Forward IPv4 with stream option to FortiOS.

ipv4-optsecurity

Security option anomalies.

option

Option	Description
allow	Allow IPv4 with security option to pass.
drop	Drop IPv4 with security option.
trap-to-host	Forward IPv4 with security option to FortiOS.

ipv4-opttimestamp

Timestamp option anomalies.

option

Option	Description
allow	Allow IPv4 with timestamp option to pass.
drop	Drop IPv4 with timestamp option.
trap-to-host	Forward IPv4 with timestamp option to FortiOS.

ipv4-csum-err

Invalid IPv4 IP checksum anomalies.

option

Option	Description
drop	Drop IPv4 invalid IP checksum.
trap-to-host	Forward IPv4 invalid IP checksum to main CPU for processing.

tcp-csum-err

Invalid IPv4 TCP checksum anomalies.

option

Option	Description
drop	Drop IPv4 invalid TCP checksum.
trap-to-host	Forward IPv4 invalid TCP checksum to main CPU for processing.

udp-csum-err

Invalid IPv4 UDP checksum anomalies.

option

Option	Description
drop	Drop IPv4 invalid UDP checksum.
trap-to-host	Forward IPv4 invalid UDP checksum to main CPU for processing.

icmp-csum-err

Invalid IPv4 ICMP checksum anomalies.

option

Option	Description
drop	Drop IPv4 invalid ICMP checksum.
trap-to-host	Forward IPv4 invalid ICMP checksum to main CPU for processing.

ipv6-land

Land anomalies.

option

Option	Description
allow	Allow IPv6 land attack to pass.
drop	Drop IPv6 land attack.
trap-to-host	Forward IPv6 land attack to FortiOS.

ipv6-proto-err

Layer 4 invalid protocol anomalies.

option

Option	Description
allow	Allow IPv6 L4 invalid protocol to pass.
drop	Drop IPv6 L4 invalid protocol.
trap-to-host	Forward IPv6 L4 invalid protocol to FortiOS.

ipv6-unknopt

Unknown option anomalies.

option

Option	Description
allow	Allow IPv6 with unknown options to pass.
drop	Drop IPv6 with unknown options.
trap-to-host	Forward IPv6 with unknown options to FortiOS.

ipv6-saddr-err

Source address as multicast anomalies.

option

Option	Description
allow	Allow IPv6 with source address as multicast to pass.
drop	Drop IPv6 with source address as multicast.
trap-to-host	Forward IPv6 with source address as multicast to FortiOS.

ipv6-daddr-err

Destination address as unspecified or loopback address anomalies.

option

Option	Description
allow	Allow IPv6 with destination address as unspecified or loopback address to pass.
drop	Drop IPv6 with destination address as unspecified or loopback address.
trap-to-host	Forward IPv6 with destination address as unspecified or loopback address to FortiOS.

ipv6-optralert

Router alert option anomalies.

option

Option	Description
allow	Allow IPv6 with router alert option to pass.
drop	Drop IPv6 with router alert option.
trap-to-host	Forward IPv6 with router alert option to FortiOS.

ipv6-optjumbo

Jumbo options anomalies.

option

Option	Description
allow	Allow IPv6 with jumbo option to pass.
drop	Drop IPv6 with jumbo option.
trap-to-host	Forward IPv6 with jumbo option to FortiOS.

ipv6-opttunnel

Tunnel encapsulation limit option anomalies.

option

Option	Description
allow	Allow IPv6 with tunnel encapsulation limit to pass.
drop	Drop IPv6 with tunnel encapsulation limit.
trap-to-host	Forward IPv6 with tunnel encapsulation limit to FortiOS.

ipv6-opthomeaddr

Home address option anomalies.

option

Option	Description
allow	Allow IPv6 with home address option to pass.
drop	Drop IPv6 with home address option.
trap-to-host	Forward IPv6 with home address option to FortiOS.

ipv6-optnsap

Network service access point address option anomalies.

option

Option	Description
allow	Allow IPv6 with network service access point address option to pass.
drop	Drop IPv6 with network service access point address option.
trap-to-host	Forward IPv6 with network service access point address option to FortiOS.

ipv6-optendpid

End point identification anomalies.

option

Option	Description
allow	Allow IPv6 with end point identification option to pass.
drop	Drop IPv6 with end point identification option.
trap-to-host	Forward IPv6 with end point identification option to FortiOS.

ipv6-optinvld

Invalid option anomalies.Invalid option anomalies.

option

Option	Description
allow	Allow IPv6 with invalid option to pass.
drop	Drop IPv6 with invalid option.
trap-to-host	Forward IPv6 with invalid option to FortiOS.

config hpe

Parameter

Description

Type

Size

tcpsyn-max

Maximum TCP SYN packet rate.

integer

Minimum value: 10000 Maximum value: 4000000000

tcp-max

Maximum TCP packet rate.

integer

Minimum value: 10000 Maximum value: 4000000000

udp-max

Maximum UDP packet rate.

integer

Minimum value: 10000 Maximum value: 4000000000

icmp-max

Maximum ICMP packet rate.

integer

Minimum value: 10000 Maximum value: 4000000000

sctp-max

Maximum SCTP packet rate.

integer

Minimum value: 10000 Maximum value: 4000000000

esp-max

Maximum ESP packet rate.

integer

Minimum value: 10000 Maximum value: 4000000000

ip-frag-max

Maximum fragmented IP packet rate.

integer

Minimum value: 10000 Maximum value: 4000000000

ip-others-max

Maximum IP packet rate for other packets.

integer

Minimum value: 10000 Maximum value: 4000000000

arp-max

Maximum ARP packet rate.

integer

Minimum value: 10000 Maximum value: 4000000000

l2-others-max

Maximum L2 packet rate for L2 packets that are not ARP packets.

integer

Minimum value: 10000 Maximum value: 4000000000

enable-shaper

Enable/Disable NPU host protection engine (HPE) shaper.

option

Option	Description
disable	Disable NPU HPE shaping based on packet type.
enable	Enable NPU HPE shaping based on packet type.

config system np6xlite

Configure NP6XLITE attributes.

config system np6xlite
    Description: Configure NP6XLITE attributes.
    edit <name>
        set asicdos [disable|enable]
        set fastpath [disable|enable]
        config fp-anomaly
            Description: NP6XLITE IPv4 anomaly protection. trap-to-host forwards anomaly sessions to the CPU.
            set tcp-syn-fin [allow|drop|...]
            set tcp-fin-noack [allow|drop|...]
            set tcp-fin-only [allow|drop|...]
            set tcp-no-flag [allow|drop|...]
            set tcp-syn-data [allow|drop|...]
            set tcp-winnuke [allow|drop|...]
            set tcp-land [allow|drop|...]
            set udp-land [allow|drop|...]
            set icmp-land [allow|drop|...]
            set icmp-frag [allow|drop|...]
            set ipv4-land [allow|drop|...]
            set ipv4-proto-err [allow|drop|...]
            set ipv4-unknopt [allow|drop|...]
            set ipv4-optrr [allow|drop|...]
            set ipv4-optssrr [allow|drop|...]
            set ipv4-optlsrr [allow|drop|...]
            set ipv4-optstream [allow|drop|...]
            set ipv4-optsecurity [allow|drop|...]
            set ipv4-opttimestamp [allow|drop|...]
            set ipv4-csum-err [drop|trap-to-host]
            set tcp-csum-err [drop|trap-to-host]
            set udp-csum-err [drop|trap-to-host]
            set icmp-csum-err [drop|trap-to-host]
            set ipv6-land [allow|drop|...]
            set ipv6-proto-err [allow|drop|...]
            set ipv6-unknopt [allow|drop|...]
            set ipv6-saddr-err [allow|drop|...]
            set ipv6-daddr-err [allow|drop|...]
            set ipv6-optralert [allow|drop|...]
            set ipv6-optjumbo [allow|drop|...]
            set ipv6-opttunnel [allow|drop|...]
            set ipv6-opthomeaddr [allow|drop|...]
            set ipv6-optnsap [allow|drop|...]
            set ipv6-optendpid [allow|drop|...]
            set ipv6-optinvld [allow|drop|...]
        end
        set garbage-session-collector [disable|enable]
        config hpe
            Description: HPE configuration.
            set tcpsyn-max {integer}
            set tcp-max {integer}
            set udp-max {integer}
            set icmp-max {integer}
            set sctp-max {integer}
            set esp-max {integer}
            set ip-frag-max {integer}
            set ip-others-max {integer}
            set arp-max {integer}
            set l2-others-max {integer}
            set enable-shaper [disable|enable]
        end
        set ipsec-inner-fragment [disable|enable]
        set per-session-accounting [disable|traffic-log-only|...]
        set session-collector-interval {integer}
        set session-timeout-fixed [disable|enable]
        set session-timeout-interval {integer}
        set session-timeout-random-range {integer}
    next
end

config system np6xlite

Parameter

Description

Type

Size

asicdos *

Enable/disable NP6XLITE DoS offloading.

option

Option	Description
disable	Disable NP6XLITE DoS offloading (DoS done by host).
enable	Enable NP6XLITE DoS offloading (DoS done by asic).

fastpath

Enable/disable NP4 or NP6XLITE offloading (also called fast path).

option

Option	Description
disable	Disable NP4 or NP6XLITE offloading (fast path).
enable	Enable NP4 or NP6XLITE offloading (fast path).

garbage-session-collector

Enable/disable garbage session collector.

option

Option	Description
disable	Disable garbage session collector.
enable	Enable garbage session collector.

ipsec-inner-fragment

Enable/disable NP6XLite IPsec fragmentation type: inner.

option

Option	Description
disable	NP6XLite ipsec fragmentation type: outer.
enable	Enable NP6XLite ipsec fragmentation type: inner.

name

Device Name.

string

Maximum length: 31

per-session-accounting

Enable/disable per-session accounting.

option

Option	Description
disable	Disable per-session accounting.
traffic-log-only	Per-session accounting only for sessions with traffic logging enabled in firewall policy.
enable	Per-session accounting for all sessions.

session-collector-interval

Set garbage session collection cleanup interval.

integer

Minimum value: 1 Maximum value: 100

session-timeout-fixed

Enable/disable fixed timeout interval mode.

option

Option	Description
disable	Disable NPU session timeout at fixed interval.
enable	Enable NPU session timeout at fixed interval.

session-timeout-interval

Set session timeout interval.

integer

Minimum value: 0 Maximum value: 1000

session-timeout-random-range

Set the randomization range.

integer

Minimum value: 0 Maximum value: 1000

* This parameter may not exist in some models.

config fp-anomaly

Parameter

Description

Type

Size

tcp-syn-fin

TCP SYN flood SYN/FIN flag set anomalies.

option

Option	Description
allow	Allow TCP packets with syn_fin flag set to pass.
drop	Drop TCP packets with syn_fin flag set.
trap-to-host	Forward TCP packets with syn_fin flag set to FortiOS.

tcp-fin-noack

TCP SYN flood with FIN flag set without ACK setting anomalies.

option

Option	Description
allow	Allow TCP packets with FIN flag set without ack setting to pass.
drop	Drop TCP packets with FIN flag set without ack setting.
trap-to-host	Forward TCP packets with FIN flag set without ack setting to FortiOS.

tcp-fin-only

TCP SYN flood with only FIN flag set anomalies.

option

Option	Description
allow	Allow TCP packets with FIN flag set only to pass.
drop	Drop TCP packets with FIN flag set only.
trap-to-host	Forward TCP packets with FIN flag set only to FortiOS.

tcp-no-flag

TCP SYN flood with no flag set anomalies.

option

Option	Description
allow	Allow TCP packets without flag set to pass.
drop	Drop TCP packets without flag set.
trap-to-host	Forward TCP packets without flag set to FortiOS.

tcp-syn-data

TCP SYN flood packets with data anomalies.

option

Option	Description
allow	Allow TCP syn packets with data to pass.
drop	Drop TCP syn packets with data.
trap-to-host	Forward TCP syn packets with data to FortiOS.

tcp-winnuke

TCP WinNuke anomalies.

option

Option	Description
allow	Allow TCP packets winnuke attack to pass.
drop	Drop TCP packets winnuke attack.
trap-to-host	Forward TCP packets winnuke attack to FortiOS.

tcp-land

TCP land anomalies.

option

Option	Description
allow	Allow TCP land attack to pass.
drop	Drop TCP land attack.
trap-to-host	Forward TCP land attack to FortiOS.

udp-land

UDP land anomalies.

option

Option	Description
allow	Allow UDP land attack to pass.
drop	Drop UDP land attack.
trap-to-host	Forward UDP land attack to FortiOS.

icmp-land

ICMP land anomalies.

option

Option	Description
allow	Allow ICMP land attack to pass.
drop	Drop ICMP land attack.
trap-to-host	Forward ICMP land attack to FortiOS.

icmp-frag

Layer 3 fragmented packets that could be part of layer 4 ICMP anomalies.

option

Option	Description
allow	Allow L3 fragment packet with L4 protocol as ICMP attack to pass.
drop	Drop L3 fragment packet with L4 protocol as ICMP attack.
trap-to-host	Forward L3 fragment packet with L4 protocol as ICMP attack to FortiOS.

ipv4-land

Land anomalies.

option

Option	Description
allow	Allow IPv4 land attack to pass.
drop	Drop IPv4 land attack.
trap-to-host	Forward IPv4 land attack to FortiOS.

ipv4-proto-err

Invalid layer 4 protocol anomalies.

option

Option	Description
allow	Allow IPv4 invalid L4 protocol to pass.
drop	Drop IPv4 invalid L4 protocol.
trap-to-host	Forward IPv4 invalid L4 protocol to FortiOS.

ipv4-unknopt

Unknown option anomalies.

option

Option	Description
allow	Allow IPv4 with unknown options to pass.
drop	Drop IPv4 with unknown options.
trap-to-host	Forward IPv4 with unknown options to FortiOS.

ipv4-optrr

Record route option anomalies.

option

Option	Description
allow	Allow IPv4 with record route option to pass.
drop	Drop IPv4 with record route option.
trap-to-host	Forward IPv4 with record route option to FortiOS.

ipv4-optssrr

Strict source record route option anomalies.

option

Option	Description
allow	Allow IPv4 with strict source record route option to pass.
drop	Drop IPv4 with strict source record route option.
trap-to-host	Forward IPv4 with strict source record route option to FortiOS.

ipv4-optlsrr

Loose source record route option anomalies.

option

Option	Description
allow	Allow IPv4 with loose source record route option to pass.
drop	Drop IPv4 with loose source record route option.
trap-to-host	Forward IPv4 with loose source record route option to FortiOS.

ipv4-optstream

Stream option anomalies.

option

Option	Description
allow	Allow IPv4 with stream option to pass.
drop	Drop IPv4 with stream option.
trap-to-host	Forward IPv4 with stream option to FortiOS.

ipv4-optsecurity

Security option anomalies.

option

Option	Description
allow	Allow IPv4 with security option to pass.
drop	Drop IPv4 with security option.
trap-to-host	Forward IPv4 with security option to FortiOS.

ipv4-opttimestamp

Timestamp option anomalies.

option

Option	Description
allow	Allow IPv4 with timestamp option to pass.
drop	Drop IPv4 with timestamp option.
trap-to-host	Forward IPv4 with timestamp option to FortiOS.

ipv4-csum-err

Invalid IPv4 IP checksum anomalies.

option

Option	Description
drop	Drop IPv4 invalid IP checksum.
trap-to-host	Forward IPv4 invalid IP checksum to main CPU for processing.

tcp-csum-err

Invalid IPv4 TCP checksum anomalies.

option

Option	Description
drop	Drop IPv4 invalid TCP checksum.
trap-to-host	Forward IPv4 invalid TCP checksum to main CPU for processing.

udp-csum-err

Invalid IPv4 UDP checksum anomalies.

option

Option	Description
drop	Drop IPv4 invalid UDP checksum.
trap-to-host	Forward IPv4 invalid UDP checksum to main CPU for processing.

icmp-csum-err

Invalid IPv4 ICMP checksum anomalies.

option

Option	Description
drop	Drop IPv4 invalid ICMP checksum.
trap-to-host	Forward IPv4 invalid ICMP checksum to main CPU for processing.

ipv6-land

Land anomalies.

option

Option	Description
allow	Allow IPv6 land attack to pass.
drop	Drop IPv6 land attack.
trap-to-host	Forward IPv6 land attack to FortiOS.

ipv6-proto-err

Layer 4 invalid protocol anomalies.

option

Option	Description
allow	Allow IPv6 L4 invalid protocol to pass.
drop	Drop IPv6 L4 invalid protocol.
trap-to-host	Forward IPv6 L4 invalid protocol to FortiOS.

ipv6-unknopt

Unknown option anomalies.

option

Option	Description
allow	Allow IPv6 with unknown options to pass.
drop	Drop IPv6 with unknown options.
trap-to-host	Forward IPv6 with unknown options to FortiOS.

ipv6-saddr-err

Source address as multicast anomalies.

option

Option	Description
allow	Allow IPv6 with source address as multicast to pass.
drop	Drop IPv6 with source address as multicast.
trap-to-host	Forward IPv6 with source address as multicast to FortiOS.

ipv6-daddr-err

Destination address as unspecified or loopback address anomalies.

option

Option	Description
allow	Allow IPv6 with destination address as unspecified or loopback address to pass.
drop	Drop IPv6 with destination address as unspecified or loopback address.
trap-to-host	Forward IPv6 with destination address as unspecified or loopback address to FortiOS.

ipv6-optralert

Router alert option anomalies.

option

Option	Description
allow	Allow IPv6 with router alert option to pass.
drop	Drop IPv6 with router alert option.
trap-to-host	Forward IPv6 with router alert option to FortiOS.

ipv6-optjumbo

Jumbo options anomalies.

option

Option	Description
allow	Allow IPv6 with jumbo option to pass.
drop	Drop IPv6 with jumbo option.
trap-to-host	Forward IPv6 with jumbo option to FortiOS.

ipv6-opttunnel

Tunnel encapsulation limit option anomalies.

option

Option	Description
allow	Allow IPv6 with tunnel encapsulation limit to pass.
drop	Drop IPv6 with tunnel encapsulation limit.
trap-to-host	Forward IPv6 with tunnel encapsulation limit to FortiOS.

ipv6-opthomeaddr

Home address option anomalies.

option

Option	Description
allow	Allow IPv6 with home address option to pass.
drop	Drop IPv6 with home address option.
trap-to-host	Forward IPv6 with home address option to FortiOS.

ipv6-optnsap

Network service access point address option anomalies.

option

Option	Description
allow	Allow IPv6 with network service access point address option to pass.
drop	Drop IPv6 with network service access point address option.
trap-to-host	Forward IPv6 with network service access point address option to FortiOS.

ipv6-optendpid

End point identification anomalies.

option

Option	Description
allow	Allow IPv6 with end point identification option to pass.
drop	Drop IPv6 with end point identification option.
trap-to-host	Forward IPv6 with end point identification option to FortiOS.

ipv6-optinvld

Invalid option anomalies.Invalid option anomalies.

option

Option	Description
allow	Allow IPv6 with invalid option to pass.
drop	Drop IPv6 with invalid option.
trap-to-host	Forward IPv6 with invalid option to FortiOS.

config hpe

Parameter

Description

Type

Size

tcpsyn-max

Maximum TCP SYN packet rate.

integer

Minimum value: 10000 Maximum value: 4000000000

tcp-max

Maximum TCP packet rate.

integer

Minimum value: 10000 Maximum value: 4000000000

udp-max

Maximum UDP packet rate.

integer

Minimum value: 10000 Maximum value: 4000000000

icmp-max

Maximum ICMP packet rate.

integer

Minimum value: 10000 Maximum value: 4000000000

sctp-max

Maximum SCTP packet rate.

integer

Minimum value: 10000 Maximum value: 4000000000

esp-max

Maximum ESP packet rate.

integer

Minimum value: 10000 Maximum value: 4000000000

ip-frag-max

Maximum fragmented IP packet rate.

integer

Minimum value: 10000 Maximum value: 4000000000

ip-others-max

Maximum IP packet rate for other packets.

integer

Minimum value: 10000 Maximum value: 4000000000

arp-max

Maximum ARP packet rate.

integer

Minimum value: 10000 Maximum value: 4000000000

l2-others-max

Maximum L2 packet rate for L2 packets that are not ARP packets.

integer

Minimum value: 10000 Maximum value: 4000000000

enable-shaper

Enable/Disable NPU host protection engine (HPE) shaper.

option

Option	Description
disable	Disable NPU HPE shaping based on packet type.
enable	Enable NPU HPE shaping based on packet type.

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Unified SASE

Single Vendor SASE

Cloud Network Security

Secure Endpoint Connectivity

Web Application / API Protection

Security Operations

Security Operations Automation

Identity

Early Detection & Prevention

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Communication & Surveillance

Unified SASE

Single Vendor SASE

Secure Endpoint Connectivity

Cloud Network Security

Cloud-Native Security

Web Application / API Protection

Security Operations

Security Operations Automation

Endpoint

Data Protection

Identity

Email

Early Detection & Prevention

Expert Services

Edge Firewall

Orchestration & management

SD Branch

Application Delivery

Single Vendor SASE

Secure Endpoint Connectivity

Secure Private Access

Thin Edge

Identity

Application Gateway

Enterprise Asset Management

Endpoint Agent

Agentless Security Posture

Identity

Wireless

Switching

Identity

Privilege Acccess Management

Next Generation Firewall

Orchestration & management

Expert Services

All

All

Account Management

SAAS Management

SAAS Application Security

Managed Services

Platform as a service (PAAS)

Other SAAS Services

4D Pillars

Cloud

Popular Solutions

CLI Reference

config system np6xlite

config system np6xlite

config system np6xlite

config fp-anomaly

config hpe

config system np6xlite

config system np6xlite

config system np6xlite

config fp-anomaly

config hpe