FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
Wallerson
Staff
Staff
Article Id 362731
Description This article describes what happens when changing the 'hif-queue-customize' parameter in an HA environment.
Scope FortiGate NP7 models.
Solution

Changing 'hif-queue-customize' requires a reboot to take effect. In an HA cluster, both units will reboot at the same time.

The default value of 'hif-queue-customize' is 'numa-affinity'. The other option is 'all-cpus'.

 

The change is made in 'config system npu':

 

FW-01 # config system npu

FW-01 (npu) # set hif-queue-customize all-cpus

FW-01 (npu) # end
The configuration will take effect after system reboot.
Do you want to continue? (y/n)y

FW-01 #

 

Untitled.png

 

If 'n' is selected, the change will be discarded, so it is not possible to make the change and reboot later.

The option to minimize the impact and reduce the downtime is isolating the secondary unit by disconnecting all the cables (including the HA cables). 

 

Then proceed with the change on the secondary (via console cable). The secondary will reboot. Meanwhile, the primary will still be in production.

When the secondary is up again, it will be time to move the traffic from the primary to the secondary.

Remove all of the cables from the primary unit to isolate it. Downtime will result.

Reconnect all of the cables to the secondary unit. Proceed with the necessary tests to validate the operation of the environment.

 

If everything is working as expected, apply the NPU change to the primary unit.

When the primary is up, reconnect only the HA cables and wait for the sync.

Reconnect all the cables of the primary unit.

Contributors