Technical Tip: ipsec-asic-offload CLI command missing in new hardware utilizing CP10

This article explains a scenario that mainly occurs during the migration of the configuration. Here admin tries to migrate the configuration from the old FortiGate 601E to the new FortiGate 701G. During the process, it is observed that FortiGate 701G is not accepting the CLI command set ipsec-asic-offload disable under system global. 

Old model configuration: (Showing only relevant section):

config system global
    set ipsec-asic-offload disable
end

With this configuration, the admin intends to disable Content Processor ASIC acceleration on IPSEC traffic. CP Acceleration differs from NPU IPSEC offloading in a significant way. The Content Processor does not sit in the data-path; instead, it is leveraged as a co-processor to the CPU. When ESP packets are not handled by the NPU, FortiOS can leverage the crypto capabilities of the CP co-processor to assist with encrypting/decrypting ESP packets as needed, but packet processing still involves the CPU. By contrast, the NPU sits directly in the data-path between the CPU and physical port and can fully encrypt/decrypt ESP packets without leveraging the FortiGate's CPU if the session meets offloading criteria.

However, this command will fail to execute in FortiGate 700G or 701G models. On the FortiGate 700G/701G, this parameter is intentionally absent as the CP10 Content Processor installed on this model does not have IPSEC VPN acceleration capabilities; instead, the platform fully leverages the NP7 for these tasks (Reference: CP10 capabilities).

The absence of ipsec-asic-offload on the 701G (or any CP10-equipped models) is expected as the CP10 is not designed to participate in assisting the CPU with IPsec processing, as was previously the case with the CP9 and earlier content processors.

Controlling/disabling IPsec offload (when required, e.g., troubleshooting, specific cipher incompatibilities, or forcing CPU processing):

1. Per-tunnel (recommended and still fully supported): Disable NP offload for a specific IPsec VPN:
    

config vpn ipsec phase1-interface
    edit <phase1-name>
        set npu-offload disable
    next
end

    2. Per-policy offload control (for traffic through firewall policies):

config firewall policy
    edit <policy-id>
        set auto-asic-offload disable
    next
end

Related article:

Technical Tip: FortiGate Disable Hardware Acceleration