FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
nprakash
Staff
Staff
Article Id 334014
Description This article describes an issue that impacts the traffic flow on NP7 platforms with inbandwidth and outbandwidth configured on an interface.
Scope

FortiOS 7.2.6+.
FortiOS 7.6.0.

Solution

To limit bandwidth at the interface level, inbandwidth and outbandwidth are enabled on the interface as shown below:

 

config system interface
    edit wan1
        set inbandwidth 200000
        set outbandwidth 200000
end 

 

When the default-qos-type is shaping and port sharpers (inbandwith/outbandwidth) are configured on 3 or more interfaces, this issue is triggered.

Run the below command to check the default-qos-type,

FGT # show full-configuration system npu | grep qos -f
config system npu
    set default-qos-type shaping<---
end

Run the below-listed commands 5 to 8 times during the time of the issue and share the log file with FortiOS TAC for further investigation/troubleshooting: 

diag npu np7 pdq 0

diag npu np7 pba 0

diag npu np7 dsw-ingress-stats 0 verbose

diag npu np7 dsw-egress-stats 0 verbose

diag npu np7 sse-stats 0

diag npu np7 sse-cmd-stats 0

diag npu np7 dce-drop-all 0 
diag npu np7 getreg 0 qtm.qtm_dbg

fnsysctl cat /proc/net/np7/np7_0/hif_que

fnsysctl cat /proc/net/np7/np7_0/hif_stats 
fnsysctl cat /proc/net/np7/qtm

 

Workaround: 

Change default-qos-type from shaping to policing as shown below:

config system npu
    set default-qos-type policing
end

WARNING: When default-qos-type is set to shaping max-receive-unit should also be set to 6000, and all interface MTUs should be set to 6000 or less. Interface MTU will be lowered automatically.
The configuration will take effect after system reboot.
Do you want to continue? (y/n)y