Technical Tip: NP7 Protection commands

Under circumstances where LACP issues related to the NP7 are observed, the following NP7 protection commands are recommended to be configured:

config system npu
    set dedicated-management-cpu enable
    set dedicated-lacp-queue enable
    set default-qos-type policing
    set vlan-lookup-cache disable
    set htab-msg-queue dedicated
end

Below, the explanation of the commands can be found:

set dedicated-management-cpu enable --> Improve GUI and CLI responsiveness by using the following command to dedicate CPU core 0 to management tasks.
set dedicated-lacp-queue enable --> Enable dedication of HIF queue 0 for LACP. Must be used together with 'set dedicated-management-cpu enable'.
set default-qos-type policing --> For FortiGates with NP7 processors, default-qos-type is set to policing and cannot be changed. In your case, the config is currently in 'shaping', so it must be modified.
set vlan-lookup-cache disable --> Enable this option to optimize the performance of offloaded traffic passing through VLAN interfaces. Recommended to disable it due to known hardware limitations in NP7.
set htab-msg-queue dedicated --> Alleviate performance bottlenecks that may occur when hash table messages use up all of the available hyperscale NP7 data queues.

Since a reboot of the FortiGate is required during the configuration, removing the cluster member is mandatory.

Following the steps below would be recommended:

1. Disable HA config sync on both, primary/FGT1 and secondary/FGT2.

config system ha

    set sync-config disable

end

2. Configure secondary/FGT2 FortiGate as a standalone.
   • On secondary/FGT2, shut down the traffic interface, and then, the HA heartbeat interface on the external switch or from one of the FortiGates, in case of direct connection.
   • It is important to shut down the traffic interface first, and then the HA heartbeat.
   • Then apply the configuration changes, and reboot the secondary FortiGate as required:

config system interface

    edit ha1

        set status down

    next

end

3. Let the secondary FortiGate join the cluster.
   • After the secondary/FGT2 bootup, bring up the FortiGate heartbeat interface.
   • Wait for the secondary/FGT2 to join the cluster and sync sessions, routes, etc.
   • Bring up secondary/FGT2's traffic interface.
   • Do a failover, so the secondary FortiGate becomes the master and takes the traffic.

4. Configure the primary/FGT1 FortiGate (currently secondary FortiGate).
   • On the former primary FortiGate, shut down the traffic interface, and then, the HA heartbeat interface on the external switch or from one of the FortiGates in case of direct connection.

   • It is important to shut down the traffic interface first, and then the HA heartbeat.

   • Then apply the configuration changes and reboot the secondary FortiGate as required.

config system interface

    edit ha1

        set status down

    next

end

5. Let the former primary/FGT1 FortiGate join the cluster.
   • After the primary/FGT1 bootup, bring up the FortiGate heartbeat interface.
   • Wait for the primary/FGT1 to join the cluster and sync sessions, routes, etc.
   • Bring up primary/FGT1's traffic interface.

6. Enable HA config sync on both, primary/FGT1 and secondary/FGT2.

config system ha

    set sync-config enable

end

Be aware that 2 reboots will be required per FortiGate, as 'set default-qos-type policing' and 'set vlan-lookup-cache disable' commands require it when exiting 'config system npu'.

Even if both commands are applied, only 1 of them will take effect at a time.