Solution | FortiGates equipped with NP7lite processors and running FortiOS v7.6 (see: FortiGate NP7Lite architectures) have been observed to not offload VXLAN traffic when transmitted over IPsec VPN tunnels, resulting in increased CPU utilization during high traffic flow.
To confirm the issue, run the command diagnose sys session list to list sessions on the FortiGate, then check for the presence of 'ofld_fail_reason(kernel, drv):' and 'none(0)/VXLAN-ib-not-offloaded(9)':
 session info: proto=6 proto_state=01 duration=2 expire=3597 timeout=3600 refresh_dir=both flags=00000000 socktype=0 sockport=0 av_idx=0 use=3
origin-shaper=
reply-shaper=
per_ip_shaper=
class_id=0 ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255
state=may_dirty npu
statistic(bytes/packets/allow_err): org=349/5/1 reply=22713/18/1 tuples=2
tx speed(Bps/kbps): 0/0 rx speed(Bps/kbps): 0/0
orgin->sink: org pre->post, reply pre->post dev=41->42/42->41 gwy=1.1.2.2/0.0.0.0
hook=pre dir=org act=noop 1.1.1.1:60318->2.2.2.2:80(0.0.0.0:0)
hook=post dir=reply act=noop 2.2.2.2:80->1.1.1.1:60318(0.0.0.0:0)
pos/(before,after) 0/(0,0), 0/(0,0)
src_mac=6e:55:50:3e:02:f9
misc=0 policy_id=10 pol_uuid_idx=1014 auth_info=0 chk_client_info=0 vd=5
serial=00000ec4 tos=ff/ff app_list=0 app=0 url_cat=0
rpdb_link_id=00000000 ngfwid=n/a
npu_state=0x000400 ofld-O
npu info: flag=0x81/0x81, offload=9/0, ips_offload=0/0, epid=20/0, ipid=6/6, vlan=0x05ab/0x05aa
vlifid=6/0, vtag_in=0x05ab/0x0000 in_npu=1/0, out_npu=1/0, fwd_en=0/0, qid=7/0, ha_divert=0/0
no_ofld_reason:
ofld_fail_reason(kernel, drv): none/none, none(0)/VXLAN-ib-not-offloaded(9)
npu_state_err=00/00
 This issue has been investigated under Bug #1256867 and has been resolved as of FortiOS v7.6.7 and v8.0.0.
Additional notes: FortiGates with NP7 processors also support hardware offloading of locally-generated VXLAN traffic (see also: vxlan-offload {disable | enable}) When offloading is enabled, VXLAN encapsulation and decapsulation are performed in-hardware by the NPU, which reduces CPU utilization and substantially increases throughput. Local VXLAN traffic is otherwise handled by the CPU for models that do not support VXLAN offload (such as with NP6/NP6xlite/NP6lite-based platforms).
|
