config hpe

all-protocol

The optimal way to set up the NP7 HPE is to set the all-protocol option to a maximum packet rate threshold that protects the FortiGate CPU from excessive traffic. If all-protocolis set to a value other than 0, the number of host packets received for all traffic of all packet types that the HPE shapes is controlled by the all-protocol threshold. By default all-protocol is set to 400000. This default threshold is designed to work well for most FortiGates and most networks.

If you want to set different maximum packet rates for different packet types, you can disable all-protocol by setting it 0. When you do this, the NP7 HPE supports setting individual limits for the following traffic types.

tcpsyn-ack-max

Prevent SYN_ACK reflection attacks by limiting the number of TCP SYN_ACK packets received per second per host queue. The range is 1000 to 40000000 pps. TCP SYN_ACK reflection attacks consist of an attacker sending large amounts of SYN_ACK packets without first sending SYN packets. These attacks can cause high CPU usage because the firewall assumes that these SYN_ACK packets are the first packets in a session, so the packets are processed by the CPU instead of the NP7 processors. The range is 1000 to 40000000 pps.

tcpfin-rst-max

Limit the maximum number of TCP FIN and RST packets received per second per host queue. The range is 1000 to 40000000 pps.

high-priority

The NP7 HPE option allows you to set a maximum overflow limit for high-priority traffic. The range is 1000 to 40000000 packets per second per host queue.