Technical Tip: Internal Switch Fabric (ISF) explained

Description

This article describes the Internal Switch Fabric (ISF) in FortiGate appliances, including its role in interconnecting hardware components such as network processors, security processors, interfaces, and the main CPU to enable high-speed packet forwarding within the system.

Scope

FortiGate.

Solution

The Internal Switch Fabric (ISF) is the high‑speed, on‑board switching matrix that lives inside a FortiGate.

All front‑panel network interfaces that are connected to the ISF are linked together before the traffic reaches the NP (Network Processor) or the CPU.

• The ISF is usually TCAM‑enabled, which routes frames between any two ports, between a port and a virtual switch, or between a port and a fabric backplane.

•  When a packet’s source and destination ports belong to the same ISF, the packet can be processed entirely in hardware (NP/NPU) and never touch the main CPU.

•  The CLI command below creates a hardware virtual switch that groups ISF-connected interfaces, enabling low-latency switching behaviour similar to a physical switch under FortiOS control.

config system virtual-switch
    edit "test"
        set physical-switch "sw0"
    next
end

Usage of Internal Switch Fabric (ISF):

• Hardware-Based Switching: The ISF allows Layer 2 traffic to be switched directly in hardware, which significantly enhances switching performance. This hardware-based approach reduces the CPU utilisation on the FortiGate, allowing it to handle more tasks efficiently.

• NPU Hardware Acceleration: Traffic passing through the ISF can benefit from Network Processor Unit (NPU) hardware acceleration, further improving performance.

• Interface Membership: Hardware Switch interfaces that utilise the ISF can include only physical interfaces as members. These typically include RJ-45 Ethernet interfaces and SFP/SFP+ interfaces. The specific interfaces eligible for inclusion in a Hardware Switch vary by FortiGate model.

• Model-Specific Architecture: Not all FortiGate models include an ISF. For example, FortiGate-VMs and certain models, such as the FortiGate 600E and 601E, do not support Hardware Switch interfaces due to the absence of an ISF.

• Default Configuration: Devices with Hardware Switch interfaces often have a default switch interface, commonly labelled as 'internal' or 'LAN'.