Technical Tip: Traffic belonging to the same flow may not be forwarded over the same aggregate member after being offloaded by NP7Lite

FortiGate firewalls with NP7lite processors may forward traffic over a different aggregate member after the session is offloaded to NP7Lite, if an L3 or L4 hashing algorithm is used. This is caused by inconsistent hashing keys used in hashing profiles for NPU offloaded traffic.

Depending on the topology, this can cause packet loss.

A similar issue occurred in NP7 devices in earlier firmware versions, but was resolved.

Workaround:

Set the LACP algorithm to L2 with offload enabled.

config system interface

    edit "aggr4"
        set vdom "root"
        set type aggregate
        set member "port1" "port2"
        set algorithm L2
    next

end

Alternatively, disable hardware acceleration on firewall policies with aggregate interfaces or their child VLAN interfaces source or destination, see Technical Tip: FortiGate Disable Hardware Acceleration.

Resolution:

The NP7lite issue is resolved in the upcoming FortiOS v8.0.0 release. Fixes in v7.4 and v7.6 minor versions are currently being considered.