Technical Tip: Packet Handling inside NPU

Description

This article describes how the Network Processor (NP) accelerates traffic processing in FortiGate appliances by offloading supported sessions from the CPU while ensuring unsupported traffic is processed through the software path.

Scope

FortiGate.

Solution

The first packet of a new session is received by the FortiGate CPU, which evaluates and decides whether the flow can be offloaded. If it can, the CPU sends the session key (or IPsec SA) and the required action to the appropriate NP.

Further handling of the packet sent out to NP can be classified into three stages as follows:

Packets enter the NPU:

When a packet enters the NP, the entire packet is first copied to a central buffer managed by the packet buffer management subsystem. The NP module responsible for buffering packets can be called the buffer allocation engine.

Packet inside the NPU:

At a second step, a Packet Descriptor is created and stored in memory. The packet descriptor compiles only the L2, L3 & L4 headers; the payload is dropped. Because the NP does not work on the packet payload, such a packet descriptor is enough for NP processing.

This is generally the short descriptor and NOT the full packet, which will navigate through the NP functional blocks and have its information modified on the flow (there are exceptions, for instance, with IPSec, where payload is needed). Depending on the processing, flags may also be added to the packet descriptor.

Packet leaves the NPU:

When a packet has to leave the NP, the entire packet is generated from the corresponding packet descriptor, and the original payload is initially stored. The lifetime of the packet buffer and packet descriptor associated with the packet starts when the packet enters the NP and ends when the packet leaves the NP.

If, for some reason, the packet buffer is not freed when the packet has left the NP or has been dropped, a PBA leak occurs. A persistent PBA leak indicates the NP is not releasing buffers correctly, which can cause performance degradation or packet loss over time and needs further troubleshooting. 

After the NP finishes its work, the packet is sent out through the NP’s egress path to the physical port (or back to the CPU for any remaining processing). The packet then continues on its way to the destination, often at wire speed because the heavy lifting was done in hardware.

Related document:

Parallel Path Processing