Technical Tip: Solution to prevent TCP out of order on some of deployment condition

[pareenat]

Description	This article describes corner case condition cause TCP out of order on some of deployment diagram.
Scope	FortiOS.
Solution	When F5 set up Virtual Server point back to Backend Server behind FortiGate. F5 will intercept TCP handshake between client and Backend Server and shorten time different between the 3rd tcp handshake packet (‘ack’) and 1st piece of data and in some rare condition these packet will reach FortiGate almost at the same time. When the the 3rd tcp handshake packet ('ack') get handle by CPU (slow path), the 1st data would already get accelerate by Network Processor (fast path) and will increase possibility to trigger TCP out of order between these 2 packets. In order to prevent TCP out of order, it i possible to enable delay-tcp-npu-session on policy that impact from above flow. # config firewall polic     edit <>         set delay-tcp-npu-session enable