Skip to main content
yzayani
Staff
yzayani
Staff
June 29, 2026

Troubleshooting Tip: Packet drops when using NPU offload with EMAC-VLAN over LACP on NP7 platforms

  • June 29, 2026
  • 0 replies
  • 265 views

Description

This article describes an issue where traffic is silently dropped by the NP7 ASIC when NPU offload is enabled on policies using an EMAC-VLAN interface stacked over a VLAN over a LACP aggregate interface.

Scope

FortiGate NP7 platforms (2600F/2601F, 1000F/1001F). FortiOS v7.4.8 and later.

Solution

Affected environments typically have the following interface hierarchy: EMAC-VLAN -> VLAN -> LACP aggregate -> physical member port(s).

The following symptoms may be observed:

  • Traffic passes normally with NPU offload disabled on the policy, but drops silently when offload is enabled.

  • Outbound packets are visible on the sniffer at the EMAC-VLAN and VLAN layers, but no corresponding traffic is seen on the upstream device.

  • No offload failure is reported in the session list or flow debug.

  • The issue may affect both IPv4 and IPv6 traffic, including IPsec tunnels egressing through the affected interface.

  • ICMP replies or TCP retransmissions from the remote end arrive at the FortiGate but are not forwarded to the client.

  • In affected cases, the NP7 NPU sniffer will show egress traffic at the EMAC-VLAN layer with no corresponding output at the aggregate or member port level. The session-offload-stats output may show:


diagnose npu np7 session-offload-stats all
Last know error inval_iadapter


In the output below, take particular note of:

  • netdev oid :137

  • tpe_id (111:98) = 00003fff


diagnose hardware deviceinfo nic port1

Description :FortiASIC NP7 Adapter
Driver Name :FortiASIC Unified NPU Driver
pid :9
oid :137
vid :11
macid :9
eif_id :127
promiscous :1
local_port :0
vlan_wa_done :0
mtu :1500
netdev oid :137
dev-flags :1903
dev-promis :1
Current_HWaddr 00:09:0f:09:96:09
Permanent_HWaddr 84:39:8f:49:81:b5

[137]_SW: [82ee7fff,000000bb,0027f800,0000fffc,0801fffc]
[137]_HW: [82ee7fff,000000bb,0027f800,0000fffc,0801fffc]
act (01:00) = 00000003
tpv_srh (02:02) = 00000001
tpv_msk (14:03) = 00000fff
mtuv4 (28:15) = 000005dc
mtuv6 (42:29) = 000005dc
trunk_vld (43:43) = 00000000
trunk_num (51:44) = 00000000
t2p_base (64:52) = 00000000
rtag_pid (70:65) = 00000000
link_id (74:71) = 00000000
sublink_id (81:75) = 0000007f
mac_id (97:82) = 00000009
tpe_id (111:98) = 00003fff


  • This issue is resolved in FortiOS v7.6.7 and FortiOS v8.0.0.


Workaround:

  • If upgrading is not immediately possible, disable NPU offloading on the affected firewall policies and IPsec phase1 interfaces.

      Terms & ConditionsAccessibility statement