Created on 04-30-2024 04:18 AM Edited on 08-21-2024 12:23 AM By Jean-Philippe_P
Description
This article describes NP6 limitations due to which packets egressing NP6 can be out of order under certain conditions.
Scope
FortiGate with NP6 processor.
Solution
When a session is offloaded in NP6, packets can leave out of order under certain conditions:
NP6 is under load.
In cases where NP6 is under heavy load, packets can be sent out of order. To mitigate the issue, disable np-accelleration offloading (globally, or per-policy), or disable ASIC offloading per policy (which will also disable NP acceleration).
Some packets within a session are fragmented.
NP6 does not re-assemble IP-fragmented packets. These packets will be delivered to the CPU for processing and out-of-order behavior can be observed. To mitigate the issue, disable offloading (which can be policy-based).
IPsec in NP6.
IPsec packets are processed differently in NP6 and smaller packets may be processed faster than larger ones, causing them to egress out of order. Disable fastpath or modify an IPsec subengine mask.
To resolve this behavior, the following actions can be taken:
config firewall policy
set delay-tcp-npu-session enable
end
Related articles:
Technical Tip: FortiGate Disable Hardware Acceleration
Troubleshooting Tip: Is a session offloaded? (Hardware acceleration)
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.