Technical Tip: NPU Offloading and Traffic Shaping Statistics

[npaiva]

Description	This article describes information about Traffic Shaping Statistics when Hardware Offloading is enabled.
Scope	FortiGate.
Content	The Following NPU Processors do not NP6 processors and traffic shaping NP6. NP6Lite. NP6XLite. NP7XLite. Fortinet NP7 Processor does support statistics, but the QoS type has to be defined as 'policing', more information on this document: Recording NP7 traffic shaping statistics. If having an appliance using one of the unsupported Network Processors, and statistics are important, it is possible to disable hardware offloading on a Firewall Policy basis, to have statistics for the interesting flows: config firewall policy     edit <policy ID>         set auto-asic-offload disable end Behavior example: When offload is enabled (by default), the counters or statistics are not used or updated as the drops occur at the NPU (ASIC) level, and the log and statistic mechanisms are not currently supported, as stated above. The following example is a speed test on a 1GB line with ASIC offload enabled. Sessions using NPU (FortiViewSession) Traffic Shapers config list FortiView Traffic Shaping The same test with ASIC offload is disabled. Sessions without NPU, utilizing CPU FortiView Traffic Shaping Traffic Shapers config list When traffic is offloaded, the way to see if traffic is being dropped at the NPU level is to check the dce drop counters. FortiGate # diagnose npu np6 dce 0 TPE_SHAPER :0000000000182499 [94] TPE is the module responsible for policing the traffic. If the value is increasing, it means the module is dropping traffic shaped offloaded traffic, exceeding the buffer queue. Related articles: Recording NP7 traffic shaping statistics  NP6 processors and traffic shaping