Clarity on "diagnose vpn ipsec status"

Hi Alex,

Good questions. The counters shown by diagnose vpn ipsec status are packet counters, rather than bytes, sessions, or SAs.

Fortinet documents these as the number of packets encrypted/decrypted by the respective IPsec crypto processing path. The output separates the encryption/decryption and integrity processing counters.

In general, the headings identify where the IPsec crypto processing is being performed:

• NP6_0, NP6_1, etc. — processing by the corresponding NPU.
• CP9 — processing by the CP crypto processor.
• SOFTWARE — processing by the FortiGate CPU/software path.
• NPU Host Offloading — traffic handled through the NPU host-offload path rather than the normal NP6 IPsec processing path.

Fortinet also documents that when ASIC offloading is disabled on the firewall policy, the NPU hosting counter is incremented, which helps explain why this category can appear separately from the individual NP processors.

Fortinet documentation:

IPsec related diagnose commands

VPN and ASIC offload

So the useful way to interpret the output is not as a count of tunnels or SAs, but as a count of IPsec packets processed by each crypto/offload path.

Hope this clarifies the output.

question 1: what are the units of these counters?

they are packet counters, not bytes, sessions or sa.

NP6_0, NP6_1, etc. = packets encrypted/decrypted by each npu.

CP9 = packets handled by the crypto processor.

SOFTWARE = packets handled by the cpu/software path.

question 2: what is NPU Host Offloading?

this is when the traffic remains on the host/cpu forwarding path, but the npu is still used to assist with ipsec encryption/decryption.

one useful detail is auto-asic-offload. if it is disabled on the firewall policy, the session is no longer fully offloaded to the npu fast path, but the npu can still assist with the ipsec crypto operation, which can increase the NPU host offloading counter.

this is also useful during troubleshooting. for some packet/flow debugs, auto-asic-offload is temporarily disabled so the traffic stays visible to the cpu/debug process. existing sessions should also be cleared before testing, otherwise they may remain offloaded.

after troubleshooting, it should be enabled again.

fortinet references:

https://docs.fortinet.com/document/fortigate/7.6.2/administration-guide/44240/ipsec-related-diagnose-commands

https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/661836/vpn-and-asic-offload

Hi!

I.appreciate the answers. I’ve seen above references thanks to Gemini/Google but your explanations about NPU Host Offloading are no more insightful. 
If the IPsec SAs are completely offloaded (npu_flag=3) then there should be all 0’s under NPU Host Offloading, right? But that’s not the case in the referenced article. Why?

 Thanks!

Hi Alex,

Yes — your observation is valid, and the FortiOS 8.0 documentation actually demonstrates the same behavior.

npu_flag=03 indicates that the IPsec traffic is being processed by the NPU in both directions. However, it does not imply that the
NPU Host Offloading counters must be zero.

In Fortinet's current FortiOS 8.0 VPN and ASIC offload documentation, the example showing npu_flag=03 also shows non-zero values under NPU Host Offloading. This means these two indicators are not mutually exclusive.

Fortinet also documents a separate case where auto-asic-offload is disabled on the firewall policy; in that situation, traffic is not offloaded and the NPU host-offloading counter is incremented.

So I would interpret the output this way:

npu_flag=03 → the IPsec SA is NPU-offloaded in both directions.
NPU Host Offloading → a separate NPU host-offload counter, which can still increment even when the SA itself is NPU-offloaded.

Therefore, seeing non-zero NPU Host Offloading counters does not by itself indicate that the IPsec SA has fallen back from NPU offloading.

The current Fortinet references are:

FortiOS 8.0 — VPN and ASIC offload

FortiOS 8.0 — IPsec related diagnose commands

Hope this clarifies the distinction.

Hi!

Again, thanks, but AI Slop only goes so far. Can you explain what NPU Host Offloading actually is? As Fortinet employee I’m sure you’re privy to qualified information that Gemini/Google isn’t.

Thanks!

Hi Alex,

You're right to distinguish npu_flag=03 from the actual packet-processing path.

The important point is that npu_flag=03 indicates that the IPsec SA is installed in the NPU for both directions; it does not mean that every packet associated with that SA will necessarily remain on the NPU fast path.

The NPU Host Offloading counter reflects traffic handled through the host path when the session or packet cannot remain fully NPU-offloaded. This can occur even while the IPsec SA itself remains installed in the NPU.

Therefore, npu_flag=03 and a non-zero NPU Host Offloading counter are not contradictory. The flag describes the offload state of the IPsec SA, while the actual session processing path can vary depending on the traffic and current conditions.

For example, a session may initially be host-processed while a TCP session is being established, or a particular session may not be fully offloadable because of an interface, session helper, inspection, asymmetric path, or another NPU offload restriction. The session table provides the relevant details through fields such as:

offload=x/y

and

no_ofld_reason:

The most direct way to correlate this with a specific flow is to inspect:

diagnose sys session list

For aggregate NPU statistics, you can also use:

diagnose npu np7 session-offload-stats all

and compare the output over time rather than relying on a single snapshot.

So, to answer your original question directly: No, npu_flag=03 does not imply that NPU Host Offloading must remain at zero. The two indicators describe different aspects of the processing path.

I hope this clarifies why the npu_flag=03 example and the non-zero NPU Host Offloading counter are not mutually exclusive. The session-level indicators above are the appropriate way to determine why a particular flow is using the host path.

Hope this clarifies the distinction.

Hi ​@osoleimani !

Let’s be clear, you’ve not answered the second question. Based on your response, it seems you don’t know and instead proffered AI Slop.

Re-read the question, see "diagnose vpn ipsec status" shows “NP6_0”,...”, so, how does NP7 fit into this? That’s the problem with relying on AI.

Again, “I sincerely hope Fortinet bans employees from regurgitating Gemini and other AI Slop in answering queries. “I don’t know” or “I’ll find out” or nothing would be more genuine” because it gives an impression of a qualified answer, but upon scrutiny, has no value.

Thanks!