FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
Article Id 196337


This article explains limitations of the NP processor.

Certain interfaces are unable to support NP offloading.

These limits apply to virtual/software interfaces that are presented here below.





Loopback interface.

A loopback interface is a logical interface that is always up (no physical link dependency).
It is widely used to form a BGP setup with neighbors and is used as an IPsec VPN tunnel interface.

Since the interface is a software interface, it will not permit offloading to network processors.

Example of Loopback interface.


config system interface
    edit "Lo1"
        set vdom "root"
        set ip
        set allowaccess ping
        set type loopback
        set snmp-index 50



For devices with NP7, running on FortiOS 7.0.6 and 7.2.1 and above, hardware acceleration is supported on Loopback interfaces.

Refer to the below KB article:



Software switch.

Software switches are supported in certain models of FortiGate.
All of the interfaces in this virtual switch act like interfaces in a hardware switch.
In that, it has the same IP address and can be connected to the same network.

The FortiGate CPU is used to maintain the mac-port table, hence traffic would not be handled by network processors

Example of software switch interface.


config system switch-interface
    edit <interface>
        set vdom <vdom>
        set member <interface_list>
        set type switch


PPPoE Interface.

PPPoE is commonly used to connect to the provider edge.
It is handled by a PPP software process and connections are terminated in virtual interfaces where traffic is not able to be handled by hardware acceleration.

Example of PPPoE interface.


config system interface
    edit "wan1"
        set vdom "root"
        set mode pppoe
        set allowaccess ping
        set type physical
        set scan-botnet-connections block
        set role wan
        set snmp-index 1
        config ipv6
            set ip6-mode dhcp
        set username ""
         set dns-server-override disable


Use physical or VLAN interfaces that bind to fixed ports in order for traffic offloading to NP (network processors).

Related link concerning NP6 and NP6 lite acceleration: