Skip to main content
mzachar
mzachar
New Member
October 31, 2019
Solved

FG 60D and SPU/NPU offload

  • October 31, 2019
  • 3 replies
  • 8665 views

Hello Experts,

 

I am a user of FGT60D which is deployed in proxy-mode as firewall only. No UTM services.

I have not configured anything under Security Profiles

 

Recently, after upgrading my ISP bandwidth from 120Mbps to 500Mbps I have noticed my FG is now a bottleneck.

When I check Sessions widget in Dashboard I can see number of session and SPU 0.0%.

Executing diagnose sys session list command I can see that none of the sessions if offloaded to SPU/NPU with lots of reasons like no_ofld_reason:  local

no_ofld_reason:  non-npu-intf

 

 

When I connect directly to FG on DMZ port I get 100% of bandwidth.

When I connect directly to FG on Port1 which is a trunk (native vlan + a few tagged vlans; FG is DHCP server), I get 35% of bandwidth does not matter in which vlan.

 

My question is following:

FG60D has NP4Lite NPU which should allow to offload most of firewall processing from CPU to NPU. I have never deactivated it, what should I do to take advantage of NPU offloading?

 

 

    Best answer by mzachar

    UPDATE:

     

    Ok, I have gathered some more info on this topic.

    Apparently, there can be two possible causes of my traffic not being accelerated in hardware.

     

    1st. I use software switch to have set of vlans spanned on more than one hardware interface.

     

    2nd.I use proxy-mode inspection. But this one is unclear to me, because although I use proxy mode I do not think I use any proxy-based security profiles. “Firewall sessions that include proxy-based security profiles or a mixture of flow-based and proxy-based security profiles are never offloaded to network processors and are always processed by the FortiGate CPU.” after Cookbook. As I wrote before, I did not configure anything under Security Profiles if this a place mentioned in the quote.

    3 replies

    mzachar
    mzacharAuthorAnswer
    New Member
    October 31, 2019

    UPDATE:

     

    Ok, I have gathered some more info on this topic.

    Apparently, there can be two possible causes of my traffic not being accelerated in hardware.

     

    1st. I use software switch to have set of vlans spanned on more than one hardware interface.

     

    2nd.I use proxy-mode inspection. But this one is unclear to me, because although I use proxy mode I do not think I use any proxy-based security profiles. “Firewall sessions that include proxy-based security profiles or a mixture of flow-based and proxy-based security profiles are never offloaded to network processors and are always processed by the FortiGate CPU.” after Cookbook. As I wrote before, I did not configure anything under Security Profiles if this a place mentioned in the quote.

    mzachar
    mzacharAuthor
    New Member
    October 31, 2019

    SOLVED

    So it seems you need to use hardware switch to be able to take advantage of hardware acceleration. Software switch is CPU intensive and won't offload traffic to NPU/SPU hw acceleration. Now SPU usage is visible in Dashboard sessions widget and full bandwidth is available.

     

    Did not have to change inspection mode to flow-based from current proxy as I am not using any proxy security profiles.

    ede_pfau
    SuperUser
    ede_pfau
    SuperUser
    November 1, 2019

    hi,

     

    thanks again for sharing and solving it yourself. In fact, use of a software switch has long been known to put a lot of load onto the CPU. Fortunately, from midrange on FGTs often include a switch chip (ISF) so it's not that common.

    Of course, there are exceptions: the 200E doesn't have a switch chip, but the 60E does...

    Terms & ConditionsAccessibility statement
    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!