Troubleshooting Tip: Session offloaded (Hardware acceleration)
| Description | This article describes how to determine whether a specific session is offloaded and, if so, whether in one or both directions. This is also known as hardware acceleration or 'fastpath'. |
| Scope | Any FortiGate with a network processor (most models). |
| Solution | As mentioned the FortiGate Hardware Acceleration handbook, the npu_info section of a session entry answers the question of whether a session is offloaded to the network processor and if so, how (i.e., one or both directions).
npu info: flag=0x81/0x81, offload=4/4, ips_offload=0/0, epid=1/23, ipid=23/1, vlan=32779/0 Specifically, the 'offload' and 'flag' field indicates this with the following format: 'offload=(forward_direction)/(reverse_direction)' and 'flag=(forward_direction)/(reverse_direction)'. For both the offload/flag fields , the meaning of the digit in the forward and reverse direction positions signify the following state: 0=Session direction is not offloaded , handled by the FortiGate CPU. 1=Session direction is accelerated to NP1. 2=Session direction is accelerated to NP1A. 3=Session direction is accelerated to NP2. 4=Session direction is accelerated to NP4. 5=Session direction is accelerated to SP. 6=Session direction is accelerated to NPLite. 7=Session direction is accelerated to SP3. 8=Session direction is accelerated to NP6. 9=Session direction is accelerated to NP7. flag 0x81 is for regular traffic. flag 0x82 signifies traffic entering or originating from an IPSec tunnel. flag 0x89 signifies traffic entering or originating from a CAPWAP cleartext tunnel (FortiAP). Reference documentation for hardware acceleration: With this info, it is possible to analyze if traffic is getting hardware accelerated bidirectionally or only in one direction. If traffic is not offloaded in any direction, it would appear as follows: offload=0/0 If it is offloaded, then it will take the code of the NPU processor type that the FortiGate unit is using.
For example: offload=4/4. This way, it is possible to tell that traffic is hardware offloaded in both directions and is using an NP4 processor. Related article: |
