Optimizing hardware logging performance using AUX interfaces

The FortiGate-4200F, 4201F, 4400F, and 4401F models include AUX1 and AUX2 interfaces that can be used for hardware logging. To use these interfaces for hardware logging you must use the following command:

config system npu

config port-path-option

set ports-using-npu {aux1 aux2}

end

ports-using-npu select one or more interfaces to use for hardware logging.

Changing the port-path-option configuration restarts the FortiGate, temporarily interrupting traffic. If you have two FortiGates in an FGCP HA cluster, you should remove the backup FortiGate from the cluster, change the port-path-option configuration on both FortiGates, and then after they restart, add the backup FortiGate back to the cluster.

For example, select AUX1 or AUX2 for hardware logging. When you add AUX1 or AUX2 to this list, hardware logging packets can be sent directly from NP7 processors over the ISF to that interface, bypassing the CPU. If you don't add interfaces to this list, the CPU is not bypassed, resulting in lower hardware logging performance. Using AUX1 or AUX2 for hardware logging may also improve hardware logging performance by separating logging traffic from data traffic.

You can also use this command to improve HA heartbeat and session sync performance. See Optimizing HA hardware session synchronization performance.

You can use multiple interfaces for hardware logging. Each interface must have an IP address and be able to communicate with your logging servers. The interfaces that you use for hardware logging should not be used for any other traffic.

For example, create the following configuration to use the AUX1 and AUX2 interfaces for hardware logging.

config system npu

config port-path-option

set ports-using-npu aux1 aux2

end